Closed
Description
The flow allowing users to change their current password is missing the part validating that the old password is indeed the correct one.
There's two logic :
- One, as an admin, allowing me to change the password of any user. This one is used to reset, as an admin, the password of a user when this one forget it.
- One, as a regular user, allowing me to change my password. This flow is done from your settings page and requires you to know your current password.
The logic is here.