[Outreachy Task Submission] Security Issues With Email And Password Update

[Aquilaafuadajo]

Description

I have some security concerns concerning the way passwords are being updated at the moment. Ideally what I expected to see was 3 input fields (old password, new password, confirm new password) but I only saw 2 which is new password and confirm new password. There's no way to ensure that it's the legitimate owner of the account initiating the password update.
I have the same concerns too for email update, there's no extra step in verifying the legitimacy of the user initiating this request.
I'm curious if there are any insights behind this implementation.

Proposal

• Introduce a new field for old password to verify the legitimacy of the user.
• Once password update is successful, log the user out and prompt them to re-authenticate.
• For email update I have two suggestions:
  1. email field should be uneditable
  2. Update to email field should require password to be inputed to validate the current user