Method PasswordUpdate

pkg/server/controllers/users.go:463–506

(w http.ResponseWriter, r *http.Request)

}

func (u *Users) PasswordUpdate(w http.ResponseWriter, r *http.Request) {
	vd := views.Data{}

	user := context.User(r.Context())
	if user == nil {
		handleHTMLError(w, r, app.ErrLoginRequired, "No authenticated user found", u.SettingView, vd)
		return
	}

	var form updatePasswordForm
	if err := parseRequestData(r, &form); err != nil {
		handleHTMLError(w, r, err, "parsing payload", u.LoginView, vd)
		return
	}

	if form.OldPassword == "" || form.NewPassword == "" {
		handleHTMLError(w, r, app.ErrInvalidPasswordChangeInput, "invalid params", u.SettingView, vd)
		return
	}
	if form.NewPassword != form.NewPasswordConfirmation {
		handleHTMLError(w, r, app.ErrPasswordConfirmationMismatch, "passwords do not match", u.SettingView, vd)
		return
	}

	password := []byte(form.OldPassword)
	if err := bcrypt.CompareHashAndPassword([]byte(user.Password.String), password); err != nil {
		log.WithFields(log.Fields{
			"user_id": user.ID,
		}).Warn("invalid password update attempt")
		handleHTMLError(w, r, app.ErrInvalidPassword, "invalid password", u.SettingView, vd)
		return
	}

	if err := app.UpdateUserPassword(u.app.DB, user, form.NewPassword); err != nil {
		handleHTMLError(w, r, err, "updating password", u.SettingView, vd)
		return
	}

	alert := views.Alert{
		Level:   views.AlertLvlSuccess,
		Message: "Password change successful",
	}
	views.RedirectAlert(w, r, "/", http.StatusFound, alert)
}

type updateProfileForm struct {
	Email    string `schema:"email"`