Ensure password check can only throw wrong password error (#19861)

1 files changed, 11 insertions, 1 deletions

diff --git a/core/Plugin/API.php b/core/Plugin/API.php
index a5aa8d73ee..275bbf0ed4 100644
--- a/core/Plugin/API.php
+++ b/core/Plugin/API.php
@@ -131,7 +131,17 @@ abstract class API
 
         $passwordConfirmation = Common::unsanitizeInputValue($passwordConfirmation);
 
-        if (!StaticContainer::get(PasswordVerifier::class)->isPasswordCorrect($loginCurrentUser, $passwordConfirmation)) {
+        try {
+            if (
+                !StaticContainer::get(PasswordVerifier::class)->isPasswordCorrect(
+                    $loginCurrentUser,
+                    $passwordConfirmation
+                )
+            ) {
+                throw new Exception(Piwik::translate('UsersManager_CurrentPasswordNotCorrect'));
+            }
+        } catch (Exception $e) {
+            // in case of any error (e.g. the provided password is too weak)
             throw new Exception(Piwik::translate('UsersManager_CurrentPasswordNotCorrect'));
         }
     }