From 28ddf3abdbe481b8714bdd2bc9dad43c805680e4 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Mon, 19 Sep 2016 16:14:51 +0200
Subject: Require password confirmation for changing the email

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 settings/Controller/UsersController.php | 1 +
 settings/templates/personal.php         | 1 +
 2 files changed, 2 insertions(+)

diff --git a/settings/Controller/UsersController.php b/settings/Controller/UsersController.php
index fde29de3598..4c732a94c9a 100644
--- a/settings/Controller/UsersController.php
+++ b/settings/Controller/UsersController.php
@@ -495,6 +495,7 @@ class UsersController extends Controller {
 	 *
 	 * @NoAdminRequired
 	 * @NoSubadminRequired
+	 * @PasswordConfirmationRequired
 	 *
 	 * @param string $id
 	 * @param string $mailAddress
diff --git a/settings/templates/personal.php b/settings/templates/personal.php
index 69d3660477d..94d4a39185f 100644
--- a/settings/templates/personal.php
+++ b/settings/templates/personal.php
@@ -91,6 +91,7 @@ if($_['displayNameChangeSupported']) {
 	</h2>
 	<input type="email" name="email" id="email" value="<?php p($_['email']); ?>"
 		placeholder="<?php p($l->t('Your email address'));?>"
+		class="password-confirm-required"
 		autocomplete="on" autocapitalize="off" autocorrect="off" />
 	<span class="msg"></span><br />
 	<em><?php p($l->t('For password recovery and notifications'));?></em>
-- 
cgit v1.2.3