changePassword() is accessible if the user is not logged in.

[mabelisle]

At line 47 of /src/Controller/Trait/PasswordManagementTrait.php, the variable $redirect is set but never used. There is a verification to see if the user is logged in but he is never redirected to the login action.

I recommend replacing the line with:

return $this->redirect($this->Auth->config('loginAction'));

[ajibarra]

@mabelisle It would be great if you could do a pull request so we can include the code in the next release.

[chav170]

The $redirect variable is used at:
https://github.com/CakeDC/users/blob/develop/src/Controller/Traits/PasswordManagementTrait.php#L63

The user is redirected after the password is changed successfully.

The 'changePassword' method can be used when the user is logged in or when he is not (forgot password), so the redirect is set early on depending on it.

[pedrofs]

As @chav170 said, users should be able to access the change password page anonymously in order to reset their password.

But the user should be redirected if he tries to access the page anonymously and outside of reset password flow: https://github.com/CakeDC/users/blob/develop/src/Controller/Traits/UserValidationTrait.php#L50

Right?