Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/action/OrgPasswordChangeAction.java
===================================================================
diff -u -r1e56f3aea99f6dd9c95b548e73d4696a992c25d7 -r83743057f72d69e4319966e7afb674712e8be3b0
--- lams_admin/src/java/org/lamsfoundation/lams/admin/web/action/OrgPasswordChangeAction.java	(.../OrgPasswordChangeAction.java)	(revision 1e56f3aea99f6dd9c95b548e73d4696a992c25d7)
+++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/action/OrgPasswordChangeAction.java	(.../OrgPasswordChangeAction.java)	(revision 83743057f72d69e4319966e7afb674712e8be3b0)
@@ -25,7 +25,11 @@
 
 import java.io.IOException;
 import java.security.InvalidParameterException;
+import java.util.Collection;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
+import java.util.TreeSet;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -48,6 +52,7 @@
 import org.lamsfoundation.lams.usermanagement.User;
 import org.lamsfoundation.lams.usermanagement.dto.UserDTO;
 import org.lamsfoundation.lams.usermanagement.service.IUserManagementService;
+import org.lamsfoundation.lams.util.HashUtil;
 import org.lamsfoundation.lams.util.ValidationUtil;
 import org.lamsfoundation.lams.util.WebUtil;
 import org.lamsfoundation.lams.web.session.SessionManager;
@@ -66,7 +71,8 @@
 	IUserManagementService userManagementService = AdminServiceProxy.getService(getServlet().getServletContext());
 	Organisation organisation = (Organisation) userManagementService.findById(Organisation.class, organisationID);
 	passForm.set(AttributeNames.PARAM_ORGANISATION_NAME, organisation.getName());
-
+	passForm.set("isStaffChange", true);
+	passForm.set("isLearnerChange", true);
 	passForm.set("staffPass", RandomPasswordGenerator.nextPasswordValidated());
 	passForm.set("learnerPass", RandomPasswordGenerator.nextPasswordValidated());
 
@@ -144,10 +150,12 @@
 	return null;
     }
 
+    @SuppressWarnings({ "unchecked" })
     public ActionForward changePassword(ActionMapping mapping, ActionForm form, HttpServletRequest request,
 	    HttpServletResponse response) throws IOException, JSONException {
 	UserDTO userDTO = getUserDTO();
 	Integer currentUserId = userDTO.getUserID();
+	// security check
 	if (!AdminServiceProxy.getSecurityService(getServlet().getServletContext()).isSysadmin(currentUserId,
 		"org password change", false)) {
 	    String warning = "User " + currentUserId + " is not a sysadmin";
@@ -156,30 +164,69 @@
 	    return null;
 	}
 
+	IUserManagementService userManagementService = AdminServiceProxy.getService(getServlet().getServletContext());
 	DynaActionForm passForm = (DynaActionForm) form;
 	Integer organisationID = (Integer) passForm.get(AttributeNames.PARAM_ORGANISATION_ID);
 	Boolean email = (Boolean) passForm.get("email");
 	Boolean force = (Boolean) passForm.get("force");
 
 	Boolean isStaffChange = (Boolean) passForm.get("isStaffChange");
 	Boolean isLearnerChange = (Boolean) passForm.get("isLearnerChange");
+	Set<Integer> changedUserIDs = new HashSet<Integer>();
+	// get data needed for each group
 	if (isStaffChange) {
 	    JSONArray excludedStaff = new JSONArray((String) passForm.get("excludedStaff"));
 	    String staffPass = (String) passForm.get("staffPass");
+	    Set<User> users = new HashSet<User>();
+	    // get users from both roles and add them to the same set
+	    users.addAll(userManagementService.getUsersFromOrganisationByRole(organisationID, Role.AUTHOR, true));
+	    users.addAll(userManagementService.getUsersFromOrganisationByRole(organisationID, Role.MONITOR, true));
+	    changedUserIDs.addAll(changePassword(staffPass, users, excludedStaff, force, email));
 	}
 	if (isLearnerChange) {
 	    JSONArray excludedLearners = new JSONArray((String) passForm.get("excludedLearners"));
 	    String learnerPass = (String) passForm.get("learnerPass");
+	    Collection<User> users = userManagementService.getUsersFromOrganisationByRole(organisationID, Role.LEARNER,
+		    true);
+	    changedUserIDs.addAll(changePassword(learnerPass, users, excludedLearners, force, email));
 	}
 
 	request.setAttribute("success", true);
 	return mapping.findForward("display");
     }
 
-    private void changePassword(String password, List<User> users, boolean force, boolean email) {
+    private Set<Integer> changePassword(String password, Collection<User> users, JSONArray excludedUsers, boolean force,
+	    boolean email) throws JSONException {
 	if (!ValidationUtil.isPasswordValueValid(password, password)) {
+	    // this should have been picked up by JS validator on the page!
 	    throw new InvalidParameterException("Password does not pass validation");
 	}
+	Set<Integer> changedUserIDs = new TreeSet<Integer>();
+	IUserManagementService userManagementService = AdminServiceProxy.getService(getServlet().getServletContext());
+	for (User user : users) {
+	    boolean excluded = false;
+	    // skip excluded (unchecked on the page) users
+	    for (int index = 0; index < excludedUsers.length(); index++) {
+		Integer excludedUserID = excludedUsers.getInt(index);
+		if (user.getUserId().equals(excludedUserID)) {
+		    excluded = true;
+		    break;
+		}
+	    }
+	    if (excluded) {
+		continue;
+	    }
+	    // change password
+	    String salt = HashUtil.salt();
+	    user.setSalt(salt);
+	    user.setPassword(HashUtil.sha256(password, salt));
+	    if (force) {
+		user.setChangePassword(true);
+	    }
+	    userManagementService.saveUser(user);
+	    changedUserIDs.add(user.getUserId());
+	}
+	return changedUserIDs;
     }
 
     private UserDTO getUserDTO() {
Index: lams_admin/web/WEB-INF/struts-config.xml
===================================================================
diff -u -r1e56f3aea99f6dd9c95b548e73d4696a992c25d7 -r83743057f72d69e4319966e7afb674712e8be3b0
--- lams_admin/web/WEB-INF/struts-config.xml	(.../struts-config.xml)	(revision 1e56f3aea99f6dd9c95b548e73d4696a992c25d7)
+++ lams_admin/web/WEB-INF/struts-config.xml	(.../struts-config.xml)	(revision 83743057f72d69e4319966e7afb674712e8be3b0)
@@ -163,14 +163,14 @@
 <form-bean name="OrgPasswordChangeForm" type="org.apache.struts.action.DynaActionForm">
 	<form-property name="organisationID" type="java.lang.Integer" />
 	<form-property name="orgName" type="java.lang.String" />
-	<form-property name="isStaffChange" type="java.lang.Boolean" initial="1" />
-	<form-property name="isLearnerChange" type="java.lang.Boolean" initial="1" />
+	<form-property name="isStaffChange" type="java.lang.Boolean" initial="false" />
+	<form-property name="isLearnerChange" type="java.lang.Boolean" initial="false" />
 	<form-property name="excludedLearners" type="java.lang.String" initial="[]"/>
 	<form-property name="excludedStaff" type="java.lang.String" initial="[]"/>
 	<form-property name="learnerPass" type="java.lang.String" />
 	<form-property name="staffPass" type="java.lang.String" />
-	<form-property name="email" type="java.lang.Boolean" initial="0" />
-	<form-property name="force" type="java.lang.Boolean" initial="0" />
+	<form-property name="email" type="java.lang.Boolean" initial="false" />
+	<form-property name="force" type="java.lang.Boolean" initial="false" />
 </form-bean>
   </form-beans>
 
@@ -972,6 +972,7 @@
       type="org.lamsfoundation.lams.admin.web.action.OrgPasswordChangeAction"
       name="OrgPasswordChangeForm"
       parameter="method"
+      scope="request"
     >
       <forward
         name="display"
Index: lams_admin/web/orgPasswordChange.jsp
===================================================================
diff -u -r1e56f3aea99f6dd9c95b548e73d4696a992c25d7 -r83743057f72d69e4319966e7afb674712e8be3b0
--- lams_admin/web/orgPasswordChange.jsp	(.../orgPasswordChange.jsp)	(revision 1e56f3aea99f6dd9c95b548e73d4696a992c25d7)
+++ lams_admin/web/orgPasswordChange.jsp	(.../orgPasswordChange.jsp)	(revision 83743057f72d69e4319966e7afb674712e8be3b0)
@@ -18,6 +18,7 @@
 	.changeContainer .pass {
 		display: inline-block;
 		margin-left: 20px;
+		margin-right: 10px;
 		width: 260px;
 	}
 	
@@ -93,14 +94,16 @@
 										}
 										
 										var	enabled = checkbox.prop('checked'),
-											grid = $('#' + checkbox.data('grid')).closest('.ui-jqgrid');
+											grid = $('#' + checkbox.data('grid')).closest('.ui-jqgrid'),
+											pass = checkbox.closest('.changeContainer').find('.pass');
 										// disable/enable password input depending on checkbox state
-										checkbox.closest('.changeContainer').find('.pass').prop('disabled', !enabled);
 										// hide/show users grid
 										if (enabled) {
 											grid.slideDown();
+											pass.prop('disabled', false);
 										} else {
 											grid.slideUp();
+											pass.val(null).prop('disabled', true);
 										}
 									});
 
@@ -235,6 +238,8 @@
 							grid.jqGrid('setSelection', id, false);
 						}
 					});
+
+					changeCheckboxes.trigger('change');
 				},
 			    loadError : function(xhr,st,err) {
 			    	$.jgrid.info_dialog('<fmt:message key="admin.error"/>', 
@@ -290,20 +295,22 @@
 		
 	</lams:Alert>
 	
-	<form id="OrgPasswordChangeForm" action="orgPasswordChange.do" method="post">
+	<html:form action="orgPasswordChange.do" styleId="OrgPasswordChangeForm">
 		<input type="hidden" name="method" value="changePassword" />
-		<input type="hidden" id="excludedLearners" name="excludedLearners" value="[]" />
-		<input type="hidden" id="excludedStaff" name="excludedStaff" value="[]" />
+		<html:hidden property="organisationID" />
+		<html:hidden property="orgName" />
+		<html:hidden property="excludedLearners" styleId="excludedLearners" />
+		<html:hidden property="excludedStaff" styleId="excludedStaff" />
 		
 		<div class="form-group">
 			<div class="checkbox">
 				<label>
-					<input name="email" value="true" type="checkbox"/><fmt:message key="admin.org.password.change.email" />
+					<html:checkbox property="email"><fmt:message key="admin.org.password.change.email" /></html:checkbox>
 				</label>
 			</div>
 			<div class="checkbox">
 				<label>
-					<input name="force" value="true" type="checkbox"/><fmt:message key="admin.org.password.change.force" />
+					<html:checkbox property="force"><fmt:message key="admin.org.password.change.force" /></html:checkbox>
 				</label>
 			</div>
 		</div>
@@ -324,27 +331,25 @@
 					<td class="changeContainer">
 						<div class="checkbox">
 							<label>
-								<input id="isStaffChange" name="isStaffChange" value="true" type="checkbox" checked="checked"/>
-								<fmt:message key="admin.org.password.change.is.staff" />
+								<html:checkbox property="isStaffChange" styleId="isStaffChange">
+									<fmt:message key="admin.org.password.change.is.staff" />
+								</html:checkbox>
 							</label>
 						</div>
-						<input type="text" id="staffPass" name="staffPass" class="pass form-control" maxlength="25"
-						       placeholder="<fmt:message key='admin.org.password.change.custom' />"
-						       title="<fmt:message key='admin.org.password.change.custom' />"
-							   value="<bean:write name='OrgPasswordChangeForm' property='staffPass' />" />
+						<html:text property="staffPass" styleId="staffPass" styleClass="pass form-control" maxlength="25"
+								   title="<fmt:message key='admin.org.password.change.custom' />" />
 						<i class="fa fa-refresh generatePassword" title="<fmt:message key='admin.org.password.change.generate' />"></i>
 					</td>
 					<td class="changeContainer">
 						<div class="checkbox">
 							<label>
-								<input id="isLearnerChange" name="isLearnerChange" value="true" type="checkbox" checked="checked"/>
-								<fmt:message key="admin.org.password.change.is.learner" />
+								<html:checkbox property="isLearnerChange" styleId="isLearnerChange">
+									<fmt:message key="admin.org.password.change.is.learner" />
+								</html:checkbox>
 							</label>
 						</div>
-						<input type="text" id="learnerPass" name="learnerPass" class="pass form-control" maxlength="25"
-							   placeholder="<fmt:message key='admin.org.password.change.custom' />"
-						       title="<fmt:message key='admin.org.password.change.custom' />"
-							   value="<bean:write name='OrgPasswordChangeForm' property='learnerPass' />" />
+						<html:text property="learnerPass" styleId="learnersPass" styleClass="pass form-control" maxlength="25"
+							   title="<fmt:message key='admin.org.password.change.custom' />" />
 						<i class="fa fa-refresh generatePassword" title="<fmt:message key='admin.org.password.change.generate' />"></i>
 					</td>
 				</tr>
@@ -361,5 +366,5 @@
 		<div class="pull-right voffset20">
 			<input type="submit" class="btn btn-primary" value="<fmt:message key='admin.org.password.change.submit' />" />
 		</div>
-	</form>
+	</html:form>
 </div>
\ No newline at end of file