Bug 670669 - Changing the e-mail address under account prefs does not require current password if can_change_password is false

r=dkl, a=simon

1 files changed, 18 insertions, 0 deletions

diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm
index d6c1f1225..01d5fdf4e 100644
--- a/Bugzilla/User.pm
+++ b/Bugzilla/User.pm
@@ -2357,6 +2357,19 @@ sub account_ip_login_failures {
     return $self->{account_ip_login_failures};
 }
 
+sub check_current_password {
+    my $self = shift;
+    my $password = shift || ThrowUserError("current_password_required");
+
+    my $cryptpwd
+        = $self->cryptpassword || ThrowCodeError("unable_to_retrieve_password");
+
+    if (bz_crypt($password, $cryptpwd) ne $cryptpwd) {
+        ThrowUserError("current_password_incorrect");
+    }
+
+}
+
 ###############
 # Subroutines #
 ###############
@@ -3103,6 +3116,11 @@ set_groups.
 
 C<bool> - Sets C<disable_mail> to the inverse of the boolean provided.
 
+=item C<check_current_password>
+
+C<string> - Throws an error if the supplied password does not match the
+user's current password.
+
 =back
 
 =head1 CLASS FUNCTIONS