From d05a6373beb9afee3517fa4b867c755a8d949e36 Mon Sep 17 00:00:00 2001
From: Sylvain <sylvain@sbx.pm>
Date: Wed, 20 Jul 2022 10:45:42 +0200
Subject: [PATCH] (bug) for admins and managers, the current password is not
 requested before changing their own password

---
 CHANGELOG.md                                              | 1 +
 .../src/javascript/components/user/change-password.tsx    | 8 +++++---
 .../src/javascript/components/user/user-profile-form.tsx  | 1 +
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2e016d7d9..b04aa1b52 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 - Improved calendars loading time
 - Refactored and documented the availability-slot-reservation data model
 - Display bookers names to connected users now apply to all resources
+- Fix a bug: for admins and managers, the current password is not requested before changing their own password
 - Fix a bug: missing translation for avatar changing
 - Fix a bug: unable to book a space's slot with an existing reservation
 - Fix a bug: Unable to import accounts from SSO when the transformation modal was opened but leaved empty
diff --git a/app/frontend/src/javascript/components/user/change-password.tsx b/app/frontend/src/javascript/components/user/change-password.tsx
index 27df0179e..d0307476d 100644
--- a/app/frontend/src/javascript/components/user/change-password.tsx
+++ b/app/frontend/src/javascript/components/user/change-password.tsx
@@ -9,19 +9,21 @@ import { FieldValues } from 'react-hook-form/dist/types/fields';
 import { PasswordInput } from './password-input';
 import { FormState } from 'react-hook-form/dist/types/form';
 import MemberAPI from '../../api/member';
+import { User } from '../../models/user';
 
 interface ChangePasswordProp<TFieldValues> {
   register: UseFormRegister<TFieldValues>,
   onError: (message: string) => void,
   currentFormPassword: string,
   formState: FormState<TFieldValues>,
+  user: User,
 }
 
 /**
  * This component shows a button that trigger a modal dialog to verify the user's current password.
  * If the user's current password is correct, the modal dialog is closed and the button is replaced by a form to set the new password.
  */
-export const ChangePassword = <TFieldValues extends FieldValues>({ register, onError, currentFormPassword, formState }: ChangePasswordProp<TFieldValues>) => {
+export const ChangePassword = <TFieldValues extends FieldValues>({ register, onError, currentFormPassword, formState, user }: ChangePasswordProp<TFieldValues>) => {
   const { t } = useTranslation('shared');
 
   const [isModalOpen, setIsModalOpen] = React.useState<boolean>(false);
@@ -31,8 +33,8 @@ export const ChangePassword = <TFieldValues extends FieldValues>({ register, onE
   const { handleSubmit, register: passwordRegister } = useForm<{ password: string }>();
 
   useEffect(() => {
-    MemberAPI.current().then(user => {
-      setIsPrivileged(user.role === 'admin' || user.role === 'manager');
+    MemberAPI.current().then(operator => {
+      setIsPrivileged((operator.role === 'admin' || operator.role === 'manager') && user.id !== operator.id);
     }).catch(error => onError(error));
   }, []);
 
diff --git a/app/frontend/src/javascript/components/user/user-profile-form.tsx b/app/frontend/src/javascript/components/user/user-profile-form.tsx
index 040335ba7..4b8ed9336 100644
--- a/app/frontend/src/javascript/components/user/user-profile-form.tsx
+++ b/app/frontend/src/javascript/components/user/user-profile-form.tsx
@@ -252,6 +252,7 @@ export const UserProfileForm: React.FC<UserProfileFormProps> = ({ action, size,
             { action === 'update' && <ChangePassword register={register}
                                                      onError={onError}
                                                      currentFormPassword={output.password}
+                                                     user={user}
                                                      formState={formState} />}
             {action === 'create' && <PasswordInput register={register}
               currentFormPassword={output.password}