Repository: ckan/ckan

Issue:
Sysadmin cannot edit normal user's profile
**CKAN version**
2.9.2

**Describe the bug**
When a sysadmin edit normal user's profile, ckan always reports `Old Password: incorrect password` error message.

**Steps to reproduce**
1. Login as sysadmin.
2. Select a normal user and into Manage page.
3. Typing something in the form exclude change password field.
4. Get the error message.

**Expected behavior**
Sysadmin can correctly update normal user's profile.

**Additional details**
I think that is about this:
https://github.com/ckan/ckan/blob/5e7ea57f97d03219fd2098c8d6848905ba056170/ckan/views/user.py#L287-L290
That will check if the email was changed, but it compare with `g.userobj.email`, i.e. current login user's email.
So when a sysadmin want update normal user's profile, it will always get an error about `Old Password incorrect`.
I am trying to fix it now.



Discussion:
@asas1asas200 looks like you are not entering your sysadmin password when doing the changes. The current flow could be little bit confusing or misleading because the sysadmin pass field is part of the password changing block 

In case that i missinterpreted your inputs, please reopen the issue and if possible add some additional details

Resolving patch:
diff --git a/ckan/views/user.py b/ckan/views/user.py
--- a/ckan/views/user.py
+++ b/ckan/views/user.py
@@ -263,10 +263,14 @@ def post(self, id=None):
         if not context[u'save']:
             return self.get(id)
 
+        # checks if user id match with the current logged user
         if id in (g.userobj.id, g.userobj.name):
             current_user = True
         else:
             current_user = False
+
+        # we save the username for later use.. in case the current
+        # logged in user change his username
         old_username = g.userobj.name
 
         try:
@@ -284,16 +288,33 @@ def post(self, id=None):
 
         context[u'message'] = data_dict.get(u'log_message', u'')
         data_dict[u'id'] = id
+
+        # we need this comparison when sysadmin edits a user,
+        # this will return True
+        # and we can utilize it for later use.
         email_changed = data_dict[u'email'] != g.userobj.email
 
+        # common users can edit their own profiles without providing
+        # password, but if they want to change
+        # their old password with new one... old password must be provided..
+        # so we are checking here if password1
+        # and password2 are filled so we can enter the validation process.
+        # when sysadmins edits a user he MUST provide sysadmin password.
+        # We are recognizing sysadmin user
+        # by email_changed variable.. this returns True
+        # and we are entering the validation.
         if (data_dict[u'password1']
                 and data_dict[u'password2']) or email_changed:
+
+            # getting the identity for current logged user
             identity = {
                 u'login': g.user,
                 u'password': data_dict[u'old_password']
             }
             auth = authenticator.UsernamePasswordAuthenticator()
 
+            # we are checking if the identity is not the
+            # same with the current logged user if so raise error.
             if auth.authenticate(request.environ, identity) != g.user:
                 errors = {
                     u'oldpassword': [_(u'Password entered was incorrect')]


Test patch: