code: public function actionReset($id, $code)
      {
          if (!$this->module->enablePasswordRecovery) {
              throw new NotFoundHttpException;
          }
  
          /** @var Token $token */
          $token = $this->finder->findToken(['user_id' => $id, 'code' => $code, 'type' => Token::TYPE_RECOVERY])->one();
  
          if ($token === null || $token->isExpired || $token->user === null) {
              \Yii::$app->session->setFlash('danger', \Yii::t('user', 'Recovery link is invalid or expired. Please try requesting a new one.'));
              return $this->render('/message', [
                  'title'  => \Yii::t('user', 'Invalid or expired link'),
                  'module' => $this->module,
              ]);
          }
  
          $model = \Yii::createObject([
              'class'    => RecoveryForm::className(),
              'scenario' => 'reset',
          ]);
  
          $this->performAjaxValidation($model);
  
          if ($model->load(\Yii::$app->getRequest()->post()) && $model->resetPassword($token)) {
              return $this->render('/message', [
                  'title'  => \Yii::t('user', 'Password has been changed'),
                  'module' => $this->module,
              ]);
          }
  
          return $this->render('reset', [
              'model' => $model,
          ]);
      }
docs: Displays page where user can reset password.
  @param  integer $id
  @param  string  $code
  @return string
  @throws \yii\web\NotFoundHttpException