Bug 670669 - Changing the e-mail address under account prefs does not require current password if can_change_password is false

r=dkl, a=simon

1 files changed, 1 insertions, 4 deletions

diff --git a/token.cgi b/token.cgi
index 830ecfccb..eba336d98 100755
--- a/token.cgi
+++ b/token.cgi
@@ -210,14 +210,11 @@ sub changeEmail {
     $dbh->bz_start_transaction();
     
     my $user = Bugzilla::User->check({ id => $userid });
-    my $realpassword = $user->cryptpassword;
     my $cgipassword  = $cgi->param('password');
 
     # Make sure the user who wants to change the email address
     # is the real account owner.
-    if (bz_crypt($cgipassword, $realpassword) ne $realpassword) {
-        ThrowUserError("old_password_incorrect");
-    }
+    $user->check_current_password($cgipassword);
 
     # The new email address should be available as this was 
     # confirmed initially so cancel token if it is not still available