Old password check before password update

[jakubrohleder]

I've added extra config param check_current_password_before_update with possible values of :attributes or :password and default value of false.

If config.check_current_password_before_update is set to :attributes the current_password param is checked before any update, if it is set to :password the current_password param is checked only if the request updates user password.

[booleanbetrayal]

LGTM!

[sebfie]

There is an issue with this pull request. We can use current_password to check before to update, but not after a request of password reset.

So, here is my workflow :

• I ask password reset
• I fill password and password_confirmation
• It asks me the current_password

So maybe we should be able to bypass this requirement using an extra params? Or the reset token?

@jakubrohleder Can you fix this pull request? Thx!!!

[jakubrohleder]

@sebfie Sorry for the late response, but I was on holiday. I'll look at this issue tonight / tomorrow and hopefully fix all the bugs.

[sebfie]

Perfect! Thx a lot

[jakubrohleder]

@sebfie I made a quick fix under my fork. It is not tested yet, but you can try if it works for you, I'll make a PR after preparing some decent tests.

[jakubrohleder]

@sebfie I just made a PR fixing this bug, sorry for a long time waiting.

[sebfie]

Thx