diff --git a/contrib/password_tab/password_policy_password_tab.pages.inc b/contrib/password_tab/password_policy_password_tab.pages.inc index 4342bac..e80338d 100644 --- a/contrib/password_tab/password_policy_password_tab.pages.inc +++ b/contrib/password_tab/password_policy_password_tab.pages.inc @@ -7,13 +7,26 @@ /** * Password change form. + * + * @see http://drupal.org/files/issues/verify_password.patch */ function password_policy_password_tab(&$form_state, $account) { + global $user; + + // Verify the password if the user is not an admin and if the user is editing his own page + if (!user_access('administer users') || $user->uid == $uid) { + $form['account']['currentpass'] = array('#type' => 'password', '#title' => t('Current password'), + '#description' => t('If you want to change your password, provide the current password to verify your identity.'), + '#size' => 25, + ); + } + $form['account']['pass'] = array( '#type' => 'password_confirm', '#description' => t('To change the current user password, enter the new password in both fields.'), '#size' => 25, ); + $form['#uid'] = $account->uid; $form['_account'] = array('#type' => 'value', '#value' => $account); $form['submit'] = array('#type' => 'submit', '#value' => t('Change')); @@ -27,9 +40,14 @@ function password_policy_password_tab(&$form_state, $account) { * Password change form validation. */ function password_policy_password_tab_validate($form, &$form_state) { - $values = $form_state['values']; + $account = user_load(array('uid' => $form['#uid'])); + + // Validate the current password if the user changes password + if (!user_access('administer users') && md5($form_state['values']['currentpass']) != $account->pass) { + form_set_error('currentpass', t('The old password to verify your identity is wrong.')); + } - $pass = trim($values['pass']); + $pass = trim($form_state['values']['pass']); if (empty($pass)) { form_set_error('pass', t('Your password cannot be empty.')); }