password change on account page

2 files changed, 27 insertions, 1 deletions

diff --git a/users/urls.py b/users/urls.py
index f649d11a..24230426 100644
--- a/users/urls.py
+++ b/users/urls.py
@@ -8,6 +8,7 @@ urlpatterns = [
     path('login', views.login_user, name='login'),
     path('logout', views.logout_user, name='logout'),
     path('update', views.update_user, name='update'),
+    path('changepassword', views.change_password, name='changepassword'),
 ]
 
 # Configure Admin Site
diff --git a/users/views.py b/users/views.py
index 56ea9dab..175d68e6 100644
--- a/users/views.py
+++ b/users/views.py
@@ -1,6 +1,6 @@
 from django.http import HttpResponseRedirect
 from django.shortcuts import render, redirect
-from django.contrib.auth import authenticate, login, logout
+from django.contrib.auth import authenticate, login, logout, update_session_auth_hash
 from django.contrib import messages
 from .models import UserProfile
 from django.contrib.auth.models import User
@@ -65,3 +65,28 @@ def update_user(request):
         messages.error(request, 'Unable to update profile! Please try again later.')
         return redirect('/')
 
+    
+def change_password(request):
+    username = request.user
+    old_password = request.POST['oldPassword']
+    new_password = request.POST['newPassword']
+    confirm_password = request.POST['confirmPassword']
+    if username is not None:
+        user = User.objects.get(username=username)
+        if user.check_password(old_password):
+            if new_password == confirm_password:
+                user.set_password(new_password)
+                user.save()
+                update_session_auth_hash(request, user)
+                messages.success(request, 'Password was successfully changed!')
+                return redirect('/account')
+            else:
+                messages.error(request, 'The new password and confirmation password do not match!')
+                return redirect('/account')
+        else:
+            messages.error(request, 'Old password is incorrect!')
+            return redirect('/account')
+    else:
+        messages.error(request, 'Unable to change password! Please try again later.')
+        return redirect('/')
+