Require current password even if password was expired

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/app/controllers/profiles/passwords_controller.rb b/app/controllers/profiles/passwords_controller.rb
index 0d93f5cbfdf..1191ce47eba 100644
--- a/app/controllers/profiles/passwords_controller.rb
+++ b/app/controllers/profiles/passwords_controller.rb
@@ -11,6 +11,11 @@ class Profiles::PasswordsController < ApplicationController
   end
 
   def create
+    unless @user.valid_password?(user_params[:current_password])
+      redirect_to new_profile_password_path, alert: 'You must provide a valid current password'
+      return
+    end
+
     new_password = user_params[:password]
     new_password_confirmation = user_params[:password_confirmation]