{"record":{"id":"1e9f50b5e3dd1962","repo":"louislam/dockge","slug":"incorrect-current-password","errorCode":null,"errorMessage":"Incorrect current password","messagePattern":"Incorrect current password","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"backend/util-server.ts","lineNumber":96,"sourceCode":"export function callbackResult(result : unknown, callback : unknown) {\n    if (typeof(callback) !== \"function\") {\n        log.error(\"console\", \"Callback is not a function\");\n        return;\n    }\n    callback(result);\n}\n\nexport async function doubleCheckPassword(socket : DockgeSocket, currentPassword : unknown) {\n    if (typeof currentPassword !== \"string\") {\n        throw new Error(\"Wrong data type?\");\n    }\n\n    let user = await R.findOne(\"user\", \" id = ? AND active = 1 \", [\n        socket.userID,\n    ]);\n\n    if (!user || !verifyPassword(currentPassword, user.password)) {\n        throw new Error(\"Incorrect current password\");\n    }\n\n    return user;\n}\n\nexport function fileExists(file : string) {\n    return fs.promises.access(file, fs.constants.F_OK)\n        .then(() => true)\n        .catch(() => false);\n}\n","sourceCodeStart":78,"sourceCodeEnd":107,"githubUrl":"https://github.com/louislam/dockge/blob/f809ae192b571944ad773e9866d3e67064ae8043/backend/util-server.ts#L78-L107","documentation":"doubleCheckPassword() in backend/util-server.ts looks up the active user for socket.userID and verifies the supplied currentPassword against the stored bcrypt hash via verifyPassword(). If no active user is found or verification fails, it throws 'Incorrect current password'. This is a deliberate re-authentication check before sensitive actions (called by handlers like user/account update).","triggerScenarios":"Calling a socket handler that calls doubleCheckPassword while the typed current password does not match the account's stored hash, or the user record is missing/inactive (id from socket.userID has no active row).","commonSituations":"User typo in the current-password field; Caps Lock on; password changed in another tab/session so the remembered value is stale; account deactivated while the session is still open.","solutions":["Re-enter the current password carefully (check Caps Lock / keyboard layout)","Confirm you are using the account's current password, not an old one","If the password was forgotten, use the password reset flow, then retry the action","In scripts, verify credentials independently before calling the protected handler"],"exampleFix":"// before\nsocket.emit(\"changePassword\", guessedPassword, newPassword);\n// after\nif (await verifyCurrentPasswordWithUser(this.currentPassword)) {\n  socket.emit(\"changePassword\", this.currentPassword, this.newPassword);\n} else {\n  alert(\"Current password is incorrect.\");\n}","handlingStrategy":"try-catch","validationCode":"// cannot verify the hash client-side; at minimum require a value\nif (!currentPassword || currentPassword.length === 0) {\n  showError(\"Current password is required.\");\n  return;\n}","typeGuard":null,"tryCatchPattern":"try {\n  const user = await doubleCheckPassword(socket, currentPassword);\n  // proceed with sensitive operation\n} catch (e) {\n  if (e.message === \"Incorrect current password\") {\n    showError(\"The current password you entered is incorrect.\");\n  } else throw e;\n}","preventionTips":["Double-check the current password (Caps Lock, keyboard layout) before submitting","If the password changed in another session, use the newest one","Limit retries and surface a clear message instead of resending blindly","Keep sessions and account status in sync to avoid inactive-user lookups failing"],"tags":["authentication","password","websocket","credentials"],"backgroundTag":"incorrect-password","analyzedSha":"f809ae192b571944ad773e9866d3e67064ae8043","analyzedAt":"2026-08-31T19:13:50.919Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}