
var emberUtils = require('../blueprints/_util/actionUtil.js');

/**
 * UserController
 *
 * @description :: Server-side logic for managing Users
 * @help        :: See http://links.sailsjs.org/docs/controllers
 */
var UserController = module.exports = {};

/**
 * Overridden from default blueprint.
 *
 * PUT /users/:id -> UserController.update
 */
UserController.update = function(req, res) {
  var pk      = emberUtils.requirePk(req);
  var params  = emberUtils.parseValues(req, User);

  delete params.email; // can't change email
  delete params.username; // can't change username
  delete params.password; // this is not the method to change the password

  User.update({id:pk}, params).exec(function(updateErr, user) {
    if (updateErr)
      return ErrorManager.handleError(updateErr, res);

    return res.emberOk(User, user);
  });
};

/**
 * Returns the logged in user.
 *
 * GET /user/current
 */
UserController.current = function(req, res) {
  var user = req.session.user;

  return res.emberOk(User, user);
};

/**
 * Changes the password of the current logged in user.
 *
 * PUT /users/password
 */
UserController.password = function(req, res) {
  var newPassword = req.params.all().password;
  var user        = req.session.user;

  user.password = newPassword;

  user.save(function(saveErr, user) {
    if (saveErr)
      return ErrorManager.handleError(saveErr, res);

    return res.emberOk(User, user);
  });
};

@@ -1,12 +1,48 @@
+%0Avar bcrypt     = require('bcrypt');
 %0Avar emberUt
@@ -1197,27 +1197,27 @@
 %7B%0A  var 
-newPassword
+params     
  = req.p
@@ -1231,58 +1231,435 @@
 ll()
-.password;%0A  var user        = req.session.user;%0A%0A
+;%0A  var oldPassword = params.oldPassword;%0A  var newPassword = params.newPassword;%0A  var user        = req.session.user;%0A%0A  if (!oldPassword %7C%7C !newPassword)%0A    return res.unauthorized('Invalid password');%0A%0A  bcrypt.compare(oldPassword, user.password, function(bcrypErr, isValid) %7B%0A    if (bcrypErr)%0A      return ErrorManager.handleError(bcrypErr, res);%0A%0A    if (!isValid)%0A      return res.unauthorized('Invalid password');%0A%0A  
   us
@@ -1686,16 +1686,18 @@
 sword;%0A%0A
+  
   user.s
@@ -1718,32 +1718,34 @@
 aveErr, user) %7B%0A
+  
     if (saveErr)
@@ -1743,32 +1743,34 @@
 (saveErr)%0A      
+  
 return ErrorMana
@@ -1797,32 +1797,34 @@
 Err, res);%0A%0A    
+  
 return res.ember
@@ -1827,29 +1827,37 @@
 mberOk(User, user);%0A
+    %7D);%0A
   %7D);%0A%7D;%0A

Add password validation on change password action