server/AyaNova/biz/UserBiz.cs

@@ -153,19 +153,24 @@ namespace AyaNova.Biz
         //put
         internal bool Put(User dbObj, User inObj)
         {
-            //Replace the db object with the PUT object skipping the password and salt and Id fields
-            CopyObject.Copy(inObj, dbObj, "Id, Salt, Password");
+            //Get a snapshot of the original db value object before changes
+            User SnapshotObj = new User();
+            CopyObject.Copy(dbObj, SnapshotObj);
+
+            //Update the db object with the PUT object values
+            CopyObject.Copy(inObj, dbObj, "Id, Salt");
 
             //Is the user updating the password?
-            if (!string.IsNullOrWhiteSpace(inObj.Password) && dbObj.Password != inObj.Password)
+            if (!string.IsNullOrWhiteSpace(inObj.Password) && SnapshotObj.Password != inObj.Password)
             {
                 //YES password is being updated:                
-                inObj.Password = Hasher.hash(inObj.Salt, inObj.Password);
+                dbObj.Password = Hasher.hash(SnapshotObj.Salt, inObj.Password);
             }
             else
             {
-                //No, use the db password value
-                //Should not require any code to run as it will retain it's db value
+                //No, use the snapshot password value
+                dbObj.Password = SnapshotObj.Password;
+                dbObj.Salt = SnapshotObj.Salt;
             }
 
 
@@ -173,7 +178,7 @@ namespace AyaNova.Biz
             //this will allow EF to check it out
             ct.Entry(dbObj).OriginalValues["ConcurrencyToken"] = inObj.ConcurrencyToken;
 
-            Validate(dbObj, inObj);
+            Validate(dbObj, SnapshotObj);
             if (HasErrors)
                 return false;
 
@@ -183,15 +188,20 @@ namespace AyaNova.Biz
         //patch
         internal bool Patch(User dbObj, JsonPatchDocument<User> objectPatch, uint concurrencyToken)
         {
-            //TODO: objectPatch handle patching password
-
-            //make a snapshot of the original for validation but update the original to preserve workflow
-
-            User snapshotObj=null;
+            //make a snapshot of the original for validation but update the original to preserve workflow           
+            User snapshotObj = new User();
             CopyObject.Copy(dbObj, snapshotObj);
 
             //Do the patching
             objectPatch.ApplyTo(dbObj);
+
+            //Is the user patching the password?
+            if (!string.IsNullOrWhiteSpace(dbObj.Password) && dbObj.Password != snapshotObj.Password)
+            {
+                //YES password is being updated:                
+                dbObj.Password = Hasher.hash(dbObj.Salt, dbObj.Password);
+            }
+
             ct.Entry(dbObj).OriginalValues["ConcurrencyToken"] = concurrencyToken;
             Validate(dbObj, snapshotObj);
             if (HasErrors)
@@ -237,7 +247,7 @@ namespace AyaNova.Biz
             //run validation and biz rules
             bool isNew = currentObj == null;
 
-            
+
             if (isNew) //Yes, no currentObj
             {
                 //Not sure why we would care about this particular rule or why I added it?  Maybe it's from widget?

server/AyaNova/util/CopyObject.cs

@@ -22,7 +22,10 @@ namespace AyaNova.Util
         {
             string[] excluded = null;
             if (!string.IsNullOrEmpty(excludedProperties))
+            {
+                excludedProperties=excludedProperties.Replace(", ", ",").Replace(" ,",",").Trim();
                 excluded = excludedProperties.Split(new char[1] { ',' }, StringSplitOptions.RemoveEmptyEntries);
+            }
 
             MemberInfo[] miT = target.GetType().GetMembers(memberAccess);
             foreach (MemberInfo Field in miT)