Refs #2669: Merged password change fixes in 7404 to trunk.

git-svn-id: http://code.elgg.org/elgg/trunk@7405 36083f99-b078-4883-b0ff-0f9b5a30f544

1 files changed, 14 insertions, 0 deletions

diff --git a/actions/user/password.php b/actions/user/password.php
index ceb9d4585..32b27bf74 100644
--- a/actions/user/password.php
+++ b/actions/user/password.php
@@ -8,6 +8,7 @@
 
 gatekeeper();
 
+$current_password = get_input('current_password');
 $password = get_input('password');
 $password2 = get_input('password2');
 $user_id = get_input('guid');
@@ -19,6 +20,19 @@ if (!$user_id) {
 }
 
 if (($user) && ($password != "")) {
+	// let admin user change anyone's password without knowing it except his own.
+	if (!isadminloggedin() || isadminloggedin() && $user->guid == get_loggedin_userid()) {
+		$credentials = array(
+			'username' => $user->username,
+			'password' => $current_password
+		);
+
+		if (!pam_auth_userpass($credentials)) {
+			register_error(elgg_echo('user:password:fail:incorrect_current_password'));
+			forward(REFERER);
+		}
+	}
+
 	if (strlen($password) >= 4) {
 		if ($password == $password2) {
 			$user->salt = generate_random_cleartext_password(); // Reset the salt