Source:
public void patchReplacePasswordWithOtherUserTokenFail() throws Exception { context.turnOffAuthorisationSystem(); EPerson ePerson = EPersonBuilder.createEPerson(context) .withNameInMetadata("John", "Doe") .withEmail("Johndoe@fake-email.com") .withPassword(password) .build(); EPerson ePersonTwo = EPersonBuilder.createEPerson(context) .withNameInMetadata("Smith", "Donald") .withEmail("donaldSmith@fake-email.com") .withPassword(password) .build(); String newPassword = "newpassword"; context.restoreAuthSystemState(); List<Operation> ops = new ArrayList<Operation>(); ReplaceOperation replaceOperation = new ReplaceOperation("/password", newPassword); ops.add(replaceOperation); String patchBody = getPatchContent(ops); accountService.sendRegistrationInfo(context, ePerson.getEmail()); accountService.sendRegistrationInfo(context, ePersonTwo.getEmail()); String tokenForEPerson = registrationDataService.findByEmail(context, ePerson.getEmail()).getToken(); String tokenForEPersonTwo = registrationDataService.findByEmail(context, ePersonTwo.getEmail()).getToken(); String token = getAuthToken(admin.getEmail(), password); PasswordHash oldPassword = ePersonService.getPasswordHash(ePerson); getClient(token).perform(patch("/api/eperson/epersons/" + ePerson.getID()) .content(patchBody) .contentType(MediaType.APPLICATION_JSON_PATCH_JSON) .param("token", tokenForEPersonTwo)) .andExpect(status().isForbidden()); PasswordHash newPasswordHash = ePersonService.getPasswordHash(ePerson); assertTrue(StringUtils.equalsIgnoreCase(oldPassword.getHashString(),newPasswordHash.getHashString())); assertFalse(registrationDataService.findByEmail(context, ePerson.getEmail()) == null); context.turnOffAuthorisationSystem(); registrationDataService.deleteByToken(context, tokenForEPerson); registrationDataService.deleteByToken(context, tokenForEPersonTwo); context.restoreAuthSystemState(); }

Target:
public void patchReplacePasswordWithOtherUserTokenFail() throws Exception { context.turnOffAuthorisationSystem(); EPerson ePerson = EPersonBuilder.createEPerson(context) .withNameInMetadata("John", "Doe") .withEmail("Johndoe@fake-email.com") .withPassword(password) .build(); EPerson ePersonTwo = EPersonBuilder.createEPerson(context) .withNameInMetadata("Smith", "Donald") .withEmail("donaldSmith@fake-email.com") .withPassword(password) .build(); String newPassword = "newpassword"; context.restoreAuthSystemState(); List<Operation> ops = new ArrayList<Operation>(); ReplaceOperation replaceOperation = new ReplaceOperation("/password", newPassword); ops.add(replaceOperation); String patchBody = getPatchContent(ops); accountService.sendRegistrationInfo(context, ePerson.getEmail()); accountService.sendRegistrationInfo(context, ePersonTwo.getEmail()); String tokenForEPerson = registrationDataService.findByEmail(context, ePerson.getEmail()).getToken(); String tokenForEPersonTwo = registrationDataService.findByEmail(context, ePersonTwo.getEmail()).getToken(); PasswordHash oldPassword = ePersonService.getPasswordHash(ePerson); getClient().perform(patch("/api/eperson/epersons/" + ePerson.getID()) .content(patchBody) .contentType(MediaType.APPLICATION_JSON_PATCH_JSON) .param("token", tokenForEPersonTwo)) .andExpect(status().isUnauthorized()); PasswordHash newPasswordHash = ePersonService.getPasswordHash(ePerson); assertEquals(oldPassword.getHashString(),newPasswordHash.getHashString()); assertNotNull(registrationDataService.findByEmail(context, ePerson.getEmail())); context.turnOffAuthorisationSystem(); registrationDataService.deleteByToken(context, tokenForEPerson); registrationDataService.deleteByToken(context, tokenForEPersonTwo); context.restoreAuthSystemState(); }