From 5ddbdc8a3c8e6fd0ce8c2852d9d1b8de56cae0e9 Mon Sep 17 00:00:00 2001
From: jonfalcon <darkutubuki143@gmail.com>
Date: Sun, 31 Jan 2016 09:39:02 -0800
Subject: [PATCH] Fix validation for change password

---
 core/um-actions-account.php |  4 ++--
 core/um-actions-global.php  | 31 ++++++++++++++++---------------
 2 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/core/um-actions-account.php b/core/um-actions-account.php
index ec7a97d2..429dc90b 100644
--- a/core/um-actions-account.php
+++ b/core/um-actions-account.php
@@ -101,8 +101,8 @@
 		$ultimatemember->account->current_tab = 'general';
 
 		// change password
-		if ( $_POST['current_user_password'] != '' ) {
-			if ( !wp_check_password( $_POST['current_user_password'], um_user('user_pass'), um_user('ID') ) ) {
+		if ( $_POST['current_user_password'] != '' || $_POST['user_password'] != '' || $_POST['confirm_user_password'] != '') {
+			if ( $_POST['current_user_password'] == '' || !wp_check_password( $_POST['current_user_password'], um_user('user_pass'), um_user('ID') ) ) {
 				$ultimatemember->form->add_error('current_user_password', __('This is not your password','ultimatemember') );
 				$ultimatemember->account->current_tab = 'password';
 			} else { // correct password
diff --git a/core/um-actions-global.php b/core/um-actions-global.php
index a587e9bd..33590af9 100644
--- a/core/um-actions-global.php
+++ b/core/um-actions-global.php
@@ -1,55 +1,56 @@
 <?php
-		
+
 	/***
 	***	@adds a form identifier to form
 	***/
 	add_action('um_after_form_fields', 'um_add_form_identifier');
 	function um_add_form_identifier($args){ ?>
-	
+
 		<input type="hidden" name="form_id" id="form_id" value="<?php echo $args['form_id']; ?>" />
 
 		<?php
 	}
-	
+
 	/***
 	***	@adds a spam timestamp
 	***/
 	add_action('um_after_form_fields', 'um_add_security_checks');
+	add_action('um_account_page_hidden_fields', 'um_add_security_checks');
 	function um_add_security_checks($args){
 		global $ultimatemember;
-		
+
 		if ( is_admin() ) return;
-	
+
 		echo '<input type="hidden" name="timestamp" id="timestamp" value="'. current_time( 'timestamp' ) .'" />';
-		
+
 		?>
-		
+
 		<p class="<?php echo $ultimatemember->honeypot; ?>_name">
 			<label for="<?php echo $ultimatemember->honeypot; ?>"><?php _e( 'Only fill in if you are not human' ); ?></label>
 			<input type="text" name="<?php echo $ultimatemember->honeypot; ?>" id="<?php echo $ultimatemember->honeypot; ?>" class="input" value="" size="25" autocomplete="off" />
 		</p>
-		
+
 		<?php
 
 	}
-	
+
 	/***
 	***	@makes the honeypot invisible
 	***/
 	add_action('wp_head', 'um_add_form_honeypot_css');
 	function um_add_form_honeypot_css() { global $ultimatemember; ?>
-	
+
 		<style type="text/css">.<?php echo $ultimatemember->honeypot; ?>_name { display: none !important; }</style>
-	
+
 	<?php }
-	
+
 	/***
 	***	@empty the honeypot value
 	***/
 	add_action('wp_footer', 'um_add_form_honeypot_js', 99999999999999999 );
 	function um_add_form_honeypot_js() { global $ultimatemember; ?>
-	
+
 		<script type="text/javascript">jQuery( '#<?php echo $ultimatemember->honeypot; ?>' ).val( '' );</script>
-		
+
 	<?php
-	}
\ No newline at end of file
+	}