settings: require old password to change password (only therefore)

1 files changed, 1 insertions, 1 deletions

diff --git a/app.py b/app.py
index 367ec0f..2754b96 100644
--- a/app.py
+++ b/app.py
@@ -216,7 +216,7 @@ def settings():
                 changed = True
 
             if form.password.data:
-                g.user.change_password(form.password.data, decrypt_password(session['password']))
+                g.user.change_password(form.password.data, form.old_password.data)
                 session['password'] = encrypt_password(form.password.data)
 
                 flash(u'Passwort geändert', 'success')