From d300d9b2f2fc065350992af40af680204e05837d Mon Sep 17 00:00:00 2001
From: Trevor Slocum <trevor@rocketnine.space>
Date: Thu, 10 Jun 2021 23:56:19 -0700
Subject: [PATCH] Require confirmation when changing password

Resolves #227.
---
 imgboard.php | 4 +++-
 inc/html.php | 7 +++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/imgboard.php b/imgboard.php
index 5148429..5fae100 100644
--- a/imgboard.php
+++ b/imgboard.php
@@ -1162,9 +1162,11 @@ EOF;
 				fancyDie(__('This account may not be updated while TINYIB_MODPASS is set.'));
 			}
 
-			if (isset($_POST['password'])) {
+			if (isset($_POST['password']) && isset($_POST['confirm'])) {
 				if ($_POST['password'] == '') {
 					fancyDie(__('A password is required.'));
+				} else if ($_POST['password'] != $_POST['confirm']) {
+					fancyDie(__('Passwords do not match.'));
 				}
 
 				$account['password'] = $_POST['password'];
diff --git a/inc/html.php b/inc/html.php
index aec32f6..b4fd77b 100644
--- a/inc/html.php
+++ b/inc/html.php
@@ -1112,8 +1112,11 @@ function manageChangePasswordForm() {
 	<form id="tinyib" name="tinyib" method="post" action="?manage&changepassword">
 	<fieldset>
 	<legend>$txt_header</legend>
-	<input type="password" name="password" id="password" value="">
-	<input type="submit" value="$txt_submit" class="managebutton">
+	<table border="0">
+	<tr><td>New password</td><td><input type="password" name="password" id="password" value=""></td></tr>
+	<tr><td>Confirm</td><td><input type="password" name="confirm" id="confirm" value=""></td></tr>
+	<tr><td>&nbsp;</td><td><input type="submit" value="$txt_submit" class="managebutton"></td></tr>
+	</table>
 	<legend>
 	</fieldset>
 	</form><br>