4 files changed, 4 insertions, 8 deletions
diff --git a/routers/admin/users.go b/routers/admin/users.go
index eee0c21f44..9aa78db103 100644
--- a/routers/admin/users.go
+++ b/routers/admin/users.go
@@ -194,13 +194,12 @@ func EditUserPost(ctx *context.Context, form auth.AdminEditUserForm) {
 	}
 
 	if len(form.Password) > 0 {
-		u.Passwd = form.Password
 		var err error
 		if u.Salt, err = models.GetUserSalt(); err != nil {
 			ctx.ServerError("UpdateUser", err)
 			return
 		}
-		u.HashPassword()
+		u.HashPassword(form.Password)
 	}
 
 	u.LoginName = form.LoginName
diff --git a/routers/api/v1/admin/user.go b/routers/api/v1/admin/user.go
index 5bbb8a7afd..69e1761b09 100644
--- a/routers/api/v1/admin/user.go
+++ b/routers/api/v1/admin/user.go
@@ -126,13 +126,12 @@ func EditUser(ctx *context.APIContext, form api.EditUserOption) {
 	}
 
 	if len(form.Password) > 0 {
-		u.Passwd = form.Password
 		var err error
 		if u.Salt, err = models.GetUserSalt(); err != nil {
 			ctx.Error(500, "UpdateUser", err)
 			return
 		}
-		u.HashPassword()
+		u.HashPassword(form.Password)
 	}
 
 	u.LoginName = form.LoginName
diff --git a/routers/user/auth.go b/routers/user/auth.go
index c3fb911b07..6edcb914b1 100644
--- a/routers/user/auth.go
+++ b/routers/user/auth.go
@@ -984,7 +984,6 @@ func ResetPasswdPost(ctx *context.Context) {
 			return
 		}
 
-		u.Passwd = passwd
 		var err error
 		if u.Rands, err = models.GetUserSalt(); err != nil {
 			ctx.ServerError("UpdateUser", err)
@@ -994,7 +993,7 @@ func ResetPasswdPost(ctx *context.Context) {
 			ctx.ServerError("UpdateUser", err)
 			return
 		}
-		u.HashPassword()
+		u.HashPassword(passwd)
 		if err := models.UpdateUserCols(u, "passwd", "rands", "salt"); err != nil {
 			ctx.ServerError("UpdateUser", err)
 			return
diff --git a/routers/user/setting.go b/routers/user/setting.go
index dcd0eedb8d..b674c24b44 100644
--- a/routers/user/setting.go
+++ b/routers/user/setting.go
@@ -229,13 +229,12 @@ func SettingsSecurityPost(ctx *context.Context, form auth.ChangePasswordForm) {
 	} else if form.Password != form.Retype {
 		ctx.Flash.Error(ctx.Tr("form.password_not_match"))
 	} else {
-		ctx.User.Passwd = form.Password
 		var err error
 		if ctx.User.Salt, err = models.GetUserSalt(); err != nil {
 			ctx.ServerError("UpdateUser", err)
 			return
 		}
-		ctx.User.HashPassword()
+		ctx.User.HashPassword(form.Password)
 		if err := models.UpdateUserCols(ctx.User, "salt", "passwd"); err != nil {
 			ctx.ServerError("UpdateUser", err)
 			return