Avoid using the same password as old/new. Improving messages

Author: ajibarra

src/Controller/Traits/PasswordManagementTrait.php

@@ -63,7 +63,7 @@ public function changePassword()
             } catch (UserNotFoundException $exception) {
                 $this->Flash->error(__d('Users', 'User was not found'));
             } catch (WrongPasswordException $wpe) {
-                $this->Flash->error(__d('Users', 'The current password does not match'));
+                $this->Flash->error(__d('Users', '{0}', $wpe->getMessage()));
             } catch (Exception $exception) {
                 $this->Flash->error(__d('Users', 'Password could not be changed'));
             }

src/Model/Behavior/PasswordBehavior.php

@@ -117,7 +117,10 @@ public function changePassword(EntityInterface $user)
 
         if (!empty($user->current_password)) {
             if (!$user->checkPassword($user->current_password, $currentUser->password)) {
-                throw new WrongPasswordException(__d('Users', 'The old password does not match'));
+                throw new WrongPasswordException(__d('Users', 'The current password does not match'));
+            }
+            if ($user->current_password === $user->password_confirm) {
+                throw new WrongPasswordException(__d('Users', 'You cannot use the current password as the new one'));
             }
         }
         $user = $this->_table->save($user);