Description:

A user can update the password from Update Profile section even if the password and confirm password fields are not equal. It takes the newly updated password as the input password field ignoring the value of input confirm-password field.

Gif for the issue:

Steps to reproduce:

1. Go to My accounts.
2. Click on Profile
3. Enter different values of password and confirm password.
4. Click "Save Changes" button.
5. Enter current password.
6. Click Save.
7. Boom. You get password updated toast message and your password is updated.

Expected behavior:

It should not be able to update profile if password and confirm mismatch occur.

Actual behavior:

It's updating the password even if the password and confirm password fields are not equal.

Server Setup Information:

• Version of Rocket.Chat Server: 3.0.0-develop
• Operating System: ubuntu
• Deployment Method: meteor
• NodeJS Version: 8.16.2 - x64
• MongoDB Version: 4.0.6

Additional context

I am working on it.