Properly compare passwords when changing email address

FAForever · May 16, 2018 · b3a58cc · b3a58cc
1 parent bfbbeec
commit b3a58cc
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/main/java/com/faforever/api/user/UserService.java b/src/main/java/com/faforever/api/user/UserService.java
@@ -191,7 +191,7 @@ private void createOrUpdateMauticContact(User user, String ipAddress) {
   }
 
   public void changeEmail(String currentPassword, String newEmail, User user, String ipAddress) {
-    if (!Objects.equals(user.getPassword(), passwordEncoder.encode(currentPassword))) {
+    if (!passwordEncoder.matches(currentPassword, user.getPassword())) {
       throw new ApiException(new Error(ErrorCode.EMAIL_CHANGE_FAILED_WRONG_PASSWORD));
     }