adding a guarantee to update user with same ID

2 files changed, 8 insertions, 6 deletions

diff --git a/system/admin/handlers.go b/system/admin/handlers.go
index 0a6218c..aec3380 100644
--- a/system/admin/handlers.go
+++ b/system/admin/handlers.go
@@ -686,6 +686,7 @@ func recoveryKeyHandler(res http.ResponseWriter, req *http.Request) {
 		}
 
 		// set user with new password
+		password := req.FormValue("password")
 		usr := &user.User{}
 		u, err := db.User(email)
 		if err != nil {
@@ -713,12 +714,8 @@ func recoveryKeyHandler(res http.ResponseWriter, req *http.Request) {
 			return
 		}
 
-		update := &user.User{
-			ID:    usr.ID,
-			Email: usr.Email,
-			Hash:  usr.Hash,
-			Salt:  usr.Salt,
-		}
+		update := user.NewUser(email, password)
+		update.ID = usr.ID
 
 		err = db.UpdateUser(usr, update)
 		if err != nil {
diff --git a/system/db/user.go b/system/db/user.go
index 79838dc..a133890 100644
--- a/system/db/user.go
+++ b/system/db/user.go
@@ -61,6 +61,11 @@ func SetUser(usr *user.User) (int, error) {
 
 // UpdateUser sets key:value pairs in the db for existing user settings
 func UpdateUser(usr, updatedUsr *user.User) error {
+	// ensure user ID remains the same
+	if updatedUsr.ID != usr.ID {
+		updatedUsr.ID = usr.ID
+	}
+
 	err := store.Update(func(tx *bolt.Tx) error {
 		users := tx.Bucket([]byte("_users"))