Password reset via function weird behavior

[thecoorum]

Hey everybody!

I was configuring password reset in the application via reset function and noticed strange and unexpected behavior. The function itself requires to set a desired user password before confirmation. Then by the idea the user should enter the same password in pair with token and tokenId that came from the function. But at this step I noticed that user can enter any password and the last one will be valid. Shouldn't realm say the the initially desired password and the password that the user provided to resetPassword with tokens is invalid in case they are not the same?