From a890d1e0d30851741392e6e7f14acffe685d28e0 Mon Sep 17 00:00:00 2001
From: Chocobozzz <me@florianbigard.com>
Date: Wed, 26 Sep 2018 16:28:15 +0200
Subject: Check current password on server side

---
 .../my-account-change-password.component.html      | 10 +++----
 .../my-account-change-password.component.ts        | 33 +++++++++-------------
 client/src/app/shared/users/user.service.ts        |  3 +-
 3 files changed, 21 insertions(+), 25 deletions(-)

(limited to 'client/src')

diff --git a/client/src/app/+my-account/my-account-settings/my-account-change-password/my-account-change-password.component.html b/client/src/app/+my-account/my-account-settings/my-account-change-password/my-account-change-password.component.html
index 00b6d20fa..ae797d1bc 100644
--- a/client/src/app/+my-account/my-account-settings/my-account-change-password/my-account-change-password.component.html
+++ b/client/src/app/+my-account/my-account-settings/my-account-change-password/my-account-change-password.component.html
@@ -1,14 +1,14 @@
 <div *ngIf="error" class="alert alert-danger">{{ error }}</div>
 
-<form role="form" (ngSubmit)="checkPassword()" [formGroup]="form">
+<form role="form" (ngSubmit)="changePassword()" [formGroup]="form">
 
   <label i18n for="new-password">Change password</label>
   <input
-    type="password" id="old-password" i18n-placeholder placeholder="Old password"
-    formControlName="old-password" [ngClass]="{ 'input-error': formErrors['old-password'] }"
+    type="password" id="current-password" i18n-placeholder placeholder="Current password"
+    formControlName="current-password" [ngClass]="{ 'input-error': formErrors['current-password'] }"
   >
-  <div *ngIf="formErrors['old-password']" class="form-error">
-    {{ formErrors['old-password'] }}
+  <div *ngIf="formErrors['current-password']" class="form-error">
+    {{ formErrors['current-password'] }}
   </div>
 
   <input
diff --git a/client/src/app/+my-account/my-account-settings/my-account-change-password/my-account-change-password.component.ts b/client/src/app/+my-account/my-account-settings/my-account-change-password/my-account-change-password.component.ts
index da0021df9..e5343b33d 100644
--- a/client/src/app/+my-account/my-account-settings/my-account-change-password/my-account-change-password.component.ts
+++ b/client/src/app/+my-account/my-account-settings/my-account-change-password/my-account-change-password.component.ts
@@ -30,7 +30,7 @@ export class MyAccountChangePasswordComponent extends FormReactive implements On
 
   ngOnInit () {
     this.buildForm({
-      'old-password': this.userValidatorsService.USER_PASSWORD,
+      'current-password': this.userValidatorsService.USER_PASSWORD,
       'new-password': this.userValidatorsService.USER_PASSWORD,
       'new-confirmed-password': this.userValidatorsService.USER_CONFIRM_PASSWORD
     })
@@ -44,31 +44,26 @@ export class MyAccountChangePasswordComponent extends FormReactive implements On
                           .subscribe(() => confirmPasswordControl.setErrors({ matchPassword: true }))
   }
 
-  checkPassword () {
-    this.error = null
-    const oldPassword = this.form.value[ 'old-password' ]
+  changePassword () {
+    const currentPassword = this.form.value[ 'current-password' ]
+    const newPassword = this.form.value[ 'new-password' ]
 
-    // compare old password
-    this.authService.login(this.user.account.name, oldPassword)
-      .subscribe(
-        () => this.changePassword(),
-        err => {
-          if (err.message.indexOf('credentials are invalid') !== -1) this.error = this.i18n('Incorrect old password.')
-          else this.error = err.message
-        }
-      )
-
-  }
-
-  private changePassword () {
-    this.userService.changePassword(this.form.value[ 'new-password' ]).subscribe(
+    this.userService.changePassword(currentPassword, newPassword).subscribe(
       () => {
         this.notificationsService.success(this.i18n('Success'), this.i18n('Password updated.'))
 
         this.form.reset()
+        this.error = null
       },
 
-      err => this.error = err.message
+      err => {
+        if (err.status === 401) {
+          this.error = this.i18n('You current password is invalid.')
+          return
+        }
+
+        this.error = err.message
+      }
     )
   }
 }
diff --git a/client/src/app/shared/users/user.service.ts b/client/src/app/shared/users/user.service.ts
index fad5b0980..bd5cd45d4 100644
--- a/client/src/app/shared/users/user.service.ts
+++ b/client/src/app/shared/users/user.service.ts
@@ -17,9 +17,10 @@ export class UserService {
   ) {
   }
 
-  changePassword (newPassword: string) {
+  changePassword (currentPassword: string, newPassword: string) {
     const url = UserService.BASE_USERS_URL + 'me'
     const body: UserUpdateMe = {
+      currentPassword,
       password: newPassword
     }
 
-- 
cgit v1.2.3