Merge pull request #4001 from MrPetovan/bug/3999-fix-password-change

Fix password change

diff --git a/mod/settings.php b/mod/settings.php
index af514e3a9f26410c85624a12252699699297c76a..9af354a9bcd3df61a98bdf480826b9b21200249d 100644 (file)
--- a/mod/settings.php
+++ b/mod/settings.php
@@ -348,7 +348,6 @@ function settings_post(App $a) {
                        }
                }
 
-
                $r = q("UPDATE `user` SET `theme` = '%s' WHERE `uid` = %d",
                                dbesc($theme),
                                intval(local_user())
@@ -370,7 +369,6 @@ function settings_post(App $a) {
        call_hooks('settings_post', $_POST);
 
        if (x($_POST, 'password') || x($_POST, 'confirm')) {
-
                $newpass = $_POST['password'];
                $confirm = $_POST['confirm'];
 
@@ -385,9 +383,8 @@ function settings_post(App $a) {
                        $err = true;
         }
 
-        //  check if the old password was supplied correctly before
-        //  changing it to the new value
-        if (User::authenticate(intval(local_user()), $_POST['opassword'])) {
+        //  check if the old password was supplied correctly before changing it to the new value
+        if (!User::authenticate(intval(local_user()), $_POST['opassword'])) {
             notice(t('Wrong password.') . EOL);
             $err = true;
         }
@@ -398,14 +395,14 @@ function settings_post(App $a) {
                                dbesc($password),
                                intval(local_user())
                        );
-                       if ($r)
+                       if ($r) {
                                info(t('Password changed.') . EOL);
-                       else
+                       } else {
                                notice(t('Password update failed. Please try again.') . EOL);
+                       }
                }
        }
 
-
        $username         = ((x($_POST, 'username'))   ? notags(trim($_POST['username']))     : '');
        $email            = ((x($_POST, 'email'))      ? notags(trim($_POST['email']))        : '');
        $timezone         = ((x($_POST, 'timezone'))   ? notags(trim($_POST['timezone']))     : '');