Ask current password to change user profile

app/controllers/profile.php

@@ -26,7 +26,7 @@ Router\post_action('profile', function () {
     $user_id = SessionStorage::getInstance()->getUserId();
     $values = Request\values();
     Helper\check_csrf_values($values);
-    list($valid, $errors) = Validator\User\validate_modification($values);
+    list($valid, $errors) = Validator\User\validate_profile_modification($user_id, $values);
 
     if ($valid) {
         $new_password = empty($values['password']) ? null : $values['password'];

app/locales/ar_AR/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/cs_CZ/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/de_DE/translations.php

@@ -251,4 +251,7 @@ return array(
     'Edit' => 'Bearbeiten',
     'The user id required' => 'Die Benutzer-ID wird benötigt',
     'The username must be unique' => 'Der Benutzername muss einmalig sein',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/es_ES/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/fr_FR/translations.php

@@ -251,4 +251,7 @@ return array(
     'Edit' => 'Modifier',
     'The user id required' => 'L\'ID de l\'utilisateur est obligatoire',
     'The username must be unique' => 'Le nom d\'utilisateur doit être unique',
+    'Current Password' => 'Mot de passe actuel',
+    'New Password' => 'Nouveau mot de passe',
+    'Wrong password' => 'Mauvais mot de passe',
 );

app/locales/it_IT/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/ja_JP/translations.php

@@ -253,4 +253,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/pt_BR/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/ru_RU/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/sr_RS/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/sr_RS@latin/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/tr_TR/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/locales/zh_CN/translations.php

@@ -251,4 +251,7 @@ return array(
     // 'Edit' => '',
     // 'The user id required' => '',
     // 'The username must be unique' => '',
+    // 'Current Password' => '',
+    // 'New Password' => '',
+    // 'Wrong password' => '',
 );

app/templates/profile.php

@@ -23,13 +23,16 @@
             <?php echo Miniflux\Helper\form_hidden('id', $values) ?>
 
             <?php echo Miniflux\Helper\form_label(t('Username'), 'username') ?>
-            <?php echo Miniflux\Helper\form_text('username', $values, $errors, array('required')) ?><br/>
+            <?php echo Miniflux\Helper\form_text('username', $values, $errors, array('required')) ?>
 
-            <?php echo Miniflux\Helper\form_label(t('Password'), 'password') ?>
+            <?php echo Miniflux\Helper\form_label(t('Current Password'), 'current_password') ?>
-            <?php echo Miniflux\Helper\form_password('password', $values, $errors) ?><br/>
+            <?php echo Miniflux\Helper\form_password('current_password', $values, $errors, array('required')) ?>
+
+            <?php echo Miniflux\Helper\form_label(t('New Password'), 'password') ?>
+            <?php echo Miniflux\Helper\form_password('password', $values, $errors) ?>
 
             <?php echo Miniflux\Helper\form_label(t('Confirmation'), 'confirmation') ?>
-            <?php echo Miniflux\Helper\form_password('confirmation', $values, $errors) ?><br/>
+            <?php echo Miniflux\Helper\form_password('confirmation', $values, $errors) ?>
         </div>
 
         <div class="form-actions">

app/validators/user.php

@@ -10,6 +10,26 @@ use PicoDb\Database;
 use SimpleValidator\Validator;
 use SimpleValidator\Validators;
 
+function validate_profile_modification($user_id, array $values)
+{
+    list($result, $errors) = validate_modification($values);
+
+    if ($result) {
+        $user = UserModel\get_user_by_id($user_id);
+        $password = ! empty($values['current_password']) ? $values['current_password'] : '';
+
+        if (! password_verify($password, $user['password'])) {
+            $result = false;
+            $errors['current_password'][] = t('Wrong password');
+        }
+    }
+
+    return array(
+        $result,
+        $errors,
+    );
+}
+
 function validate_modification(array $values)
 {
     $v = new Validator($values, array(