Merge remote-tracking branch 'refs/remotes/origin/master' into blocks

public/src/client/account/edit.js

@@ -169,10 +169,9 @@ define('forum/account/edit', ['forum/account/header', 'translator', 'components'
 					confirmBtn.html('<i class="fa fa-spinner fa-spin"></i>');
 					confirmBtn.prop('disabled', true);
 
-					socket.emit('user.checkPassword', {
-						uid: parseInt(ajaxify.data.uid, 10),
+					socket.emit('user.deleteAccount', {
 						password: $('#confirm-password').val(),
-					}, function (err, ok) {
+					}, function (err) {
 						function restoreButton() {
 							translator.translate('[[modules:bootbox.confirm]]', function (confirmText) {
 								confirmBtn.text(confirmText);
@@ -183,19 +182,10 @@ define('forum/account/edit', ['forum/account/header', 'translator', 'components'
 						if (err) {
 							restoreButton();
 							return app.alertError(err.message);
-						} else if (!ok) {
-							restoreButton();
-							return app.alertError('[[error:invalid-password]]');
 						}
 
 						confirmBtn.html('<i class="fa fa-check"></i>');
-						socket.emit('user.deleteAccount', {}, function (err) {
-							if (err) {
-								return app.alertError(err.message);
-							}
-
-							window.location.href = config.relative_path + '/';
-						});
+						window.location.href = config.relative_path + '/';
 					});
 
 					return false;

src/meta/themes.js

@@ -104,9 +104,9 @@ Themes.get = function (callback) {
 						// Minor adjustments for API output
 						configObj.type = 'local';
 						if (configObj.screenshot) {
-							configObj.screenshot_url = 'css/previews/' + encodeURIComponent(configObj.id);
+							configObj.screenshot_url = nconf.get('relative_path') + '/css/previews/' + encodeURIComponent(configObj.id);
 						} else {
-							configObj.screenshot_url = 'assets/images/themes/default.png';
+							configObj.screenshot_url = nconf.get('relative_path') + '/assets/images/themes/default.png';
 						}
 						next(null, configObj);
 					} catch (err) {

src/socket.io/user.js

@@ -36,6 +36,11 @@ SocketUser.deleteAccount = function (socket, data, callback) {
 	}
 
 	async.waterfall([
+		function (next) {
+			user.isPasswordCorrect(socket.uid, data.password, function (err, ok) {
+				next(err || !ok ? new Error('[[error:invalid-password]]') : undefined);
+			});
+		},
 		function (next) {
 			user.isAdministrator(socket.uid, next);
 		},
@@ -56,7 +61,15 @@ SocketUser.deleteAccount = function (socket, data, callback) {
 			});
 			next();
 		},
-	], callback);
+	], function (err) {
+		if (err) {
+			return setTimeout(function () {
+				callback(err);
+			}, 2500);
+		}
+
+		callback();
+	});
 };
 
 SocketUser.emailExists = function (socket, data, callback) {

src/socket.io/user/profile.js

@@ -109,13 +109,6 @@ module.exports = function (SocketUser) {
 		], callback);
 	}
 
-	SocketUser.checkPassword = function (socket, data, callback) {
-		isPrivilegedOrSelfAndPasswordMatch(socket.uid, data, function (err) {
-			// Return a bool (without delayed response to prevent brute-force checking of password validity)
-			setTimeout(callback.bind(null, null, !err), 1000);
-		});
-	};
-
 	SocketUser.changePassword = function (socket, data, callback) {
 		if (!socket.uid) {
 			return callback(new Error('[[error:invalid-uid]]'));

src/views/admin/partials/theme_list.tpl

@@ -1,7 +1,7 @@
 <!-- BEGIN themes -->
 <div class="col-lg-4 col-md-6 col-sm-12 col-xs-12" data-type="{themes.type}" data-theme="{themes.id}"<!-- IF themes.css --> data-css="{themes.css}"<!-- ENDIF themes.css -->>
 	<div class="theme-card mdl-card mdl-shadow--2dp">
-		<div class="mdl-card__title mdl-card--expand" style="background-image: url('{relative_path}/{themes.screenshot_url}');"></div>
+		<div class="mdl-card__title mdl-card--expand" style="background-image: url('{themes.screenshot_url}');"></div>
 		<div class="mdl-card__supporting-text">
 			<h2 class="mdl-card__title-text">{themes.name}</h2>
 			<p>