louislam/dockge · error · Error

Incorrect current password

Error message

Incorrect current password

What it means

doubleCheckPassword() in backend/util-server.ts looks up the active user for socket.userID and verifies the supplied currentPassword against the stored bcrypt hash via verifyPassword(). If no active user is found or verification fails, it throws 'Incorrect current password'. This is a deliberate re-authentication check before sensitive actions (called by handlers like user/account update).

Source

Thrown at backend/util-server.ts:96

export function callbackResult(result : unknown, callback : unknown) {
    if (typeof(callback) !== "function") {
        log.error("console", "Callback is not a function");
        return;
    }
    callback(result);
}

export async function doubleCheckPassword(socket : DockgeSocket, currentPassword : unknown) {
    if (typeof currentPassword !== "string") {
        throw new Error("Wrong data type?");
    }

    let user = await R.findOne("user", " id = ? AND active = 1 ", [
        socket.userID,
    ]);

    if (!user || !verifyPassword(currentPassword, user.password)) {
        throw new Error("Incorrect current password");
    }

    return user;
}

export function fileExists(file : string) {
    return fs.promises.access(file, fs.constants.F_OK)
        .then(() => true)
        .catch(() => false);
}

View on GitHub (pinned to f809ae192b)

Solutions

1. Re-enter the current password carefully (check Caps Lock / keyboard layout)
2. Confirm you are using the account's current password, not an old one
3. If the password was forgotten, use the password reset flow, then retry the action
4. In scripts, verify credentials independently before calling the protected handler

Example fix

// before
socket.emit("changePassword", guessedPassword, newPassword);
// after
if (await verifyCurrentPasswordWithUser(this.currentPassword)) {
  socket.emit("changePassword", this.currentPassword, this.newPassword);
} else {
  alert("Current password is incorrect.");
}

// cannot verify the hash client-side; at minimum require a value
if (!currentPassword || currentPassword.length === 0) {
  showError("Current password is required.");
  return;
}

try {
  const user = await doubleCheckPassword(socket, currentPassword);
  // proceed with sensitive operation
} catch (e) {
  if (e.message === "Incorrect current password") {
    showError("The current password you entered is incorrect.");
  } else throw e;
}

When it happens

Trigger: Calling a socket handler that calls doubleCheckPassword while the typed current password does not match the account's stored hash, or the user record is missing/inactive (id from socket.userID has no active row).

Common situations: User typo in the current-password field; Caps Lock on; password changed in another tab/session so the remembered value is stale; account deactivated while the session is still open.

Related errors

• Password is too weak. It should contain alphabetic and numer
• Invalid new password
• You are not logged in.
• Wrong data type?
• Dockge has been initialized. If you want to run setup again,

AI-assisted analysis of louislam/dockge@f809ae192b (2026-08-31). Data as JSON: /api/errors/1e9f50b5e3dd1962. Report an issue: GitHub.