asp.net mvc 4中的忘记密码表单

我尝试在我的asp.net mvc 4项目中实现忘记密码表单，一切工作正常，但当我尝试使用新密码登录系统时，它告诉我我有错误的密码。

[HttpPost]
public ActionResult ForgetPassword(UserViewModel userModel) {
    const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
    var random = new Random();
    var result = new string(
        Enumerable.Repeat(chars, 8)
                  .Select(s => s[random.Next(s.Length)])
                  .ToArray());
    User user = _userRepo.GetUserByEmail(userModel.Email);
    if (user == null) {
        ViewBag.Error = Resources.Account.userEmailNotExist;
        return View(userModel);
    }
    String newHashedPassword = Crypto.HashPassword(result);
    user.Password = newHashedPassword;
    user.LastPasswordChangedDate = DateTime.UtcNow;
    _userRepo.SaveChanges();
    string enMessage = "Your new password: " + result;
    var httpCookie = Request.Cookies["lang"];
    if (httpCookie != null && httpCookie.Value == "en") {
        _mailHelper.SendEmail(userModel.Email, "New password", enMessage);
    }
    return RedirectToAction("ConfirmPasswordChange", "Account");
}

登录表单:

[HttpPost]
public ActionResult Login(UserViewModel user) {
    var users = _userRepo.GetAllEntitiesWithParam("JobsDb_Users_GetByEmail", user.Email).FirstOrDefault();
    ...
    try {
        var tryLogin = WebSecurity.Login(users.Username, user.Password, true);
        if (tryLogin == WebSecurity.MembershipLoginStatus.Failure)
        {
            var httpCookie = Request.Cookies["lang"];
            if (httpCookie != null && httpCookie.Value == "en") {
                ViewBag.Error = "Your password is incorrect.";
                new SeoHelper().ReturnSeoTags(this, "Login");
            }
            return View(user);
        }
        ...
    } catch {
        ...
    }
}

在WebSecurity

public static MembershipLoginStatus Login(string username, string password, bool rememberMe) {
    if (Membership.ValidateUser(username, password)) {
        FormsAuthentication.SetAuthCookie(username, rememberMe);
        return MembershipLoginStatus.Success;
    } else {
        return MembershipLoginStatus.Failure;
    }
}

里面的会员

public override bool ValidateUser(string username, string password) {
    if (string.IsNullOrEmpty(username)) {
        return false;
    }
    if (string.IsNullOrEmpty(password)) {
        return false;
    }
    User user = _userRepository.GetAll().FirstOrDefault(usr => usr.Username == username);
    if (user == null) {
        return false;
    }
    if (!user.IsApproved.Value) {
        return false;
    }
    if (user.IsLockedOut.Value) {
        return false;
    }
    String hashedPassword = user.Password;
    Boolean verificationSucceeded = (hashedPassword != null && Crypto.VerifyHashedPassword(hashedPassword, password));
    if (verificationSucceeded) { //here is I have false if try to login using password from forget form
        user.PasswordFailuresSinceLastSuccess = 0;
        user.LastLoginDate = DateTime.UtcNow;
        user.LastActivityDate = DateTime.UtcNow;
    } else {
        int failures = user.PasswordFailuresSinceLastSuccess.Value;
        if (failures < MaxInvalidPasswordAttempts) {
            user.PasswordFailuresSinceLastSuccess += 1;
            user.LastPasswordFailureDate = DateTime.UtcNow;
        } else if (failures >= MaxInvalidPasswordAttempts) {
            user.LastPasswordFailureDate = DateTime.UtcNow;
            user.LastLockoutDate = DateTime.UtcNow;
            user.IsLockedOut = true;
        }
    }
    _userRepository.SaveChanges();
    if (verificationSucceeded) {
        return true;
    }
    return false;
}

    User user = _userRepo.GetUserByEmail(userModel.Email);
    if (user == null) {
        ViewBag.Error = Resources.Account.userEmailNotExist;
        return View(userModel);
    }
    String newHashedPassword = Crypto.HashPassword(result);
    user.Password = newHashedPassword;
    user.LastPasswordChangedDate = DateTime.UtcNow;
    _userRepo.SaveChanges();