add separate validation check for password on update

logic/auth.go

@@ -268,10 +268,6 @@ func UpdateUser(userchange, user *models.User) (*models.User, error) {
 	if _, err := GetUser(user.UserName); err != nil {
 		return &models.User{}, err
 	}
-	err := ValidateUser(userchange)
-	if err != nil {
-		return &models.User{}, err
-	}
 
 	queryUser := user.UserName
 	if userchange.UserName != "" && user.UserName != userchange.UserName {
@@ -282,6 +278,9 @@ func UpdateUser(userchange, user *models.User) (*models.User, error) {
 		user.UserName = userchange.UserName
 	}
 	if userchange.Password != "" {
+		if len(userchange.Password) < 5 {
+			return &models.User{}, errors.New("password requires min 5 characters")
+		}
 		// encrypt that password so we never see it again
 		hash, err := bcrypt.GenerateFromPassword([]byte(userchange.Password), 5)
 
@@ -306,7 +305,10 @@ func UpdateUser(userchange, user *models.User) (*models.User, error) {
 	}
 	user.UserGroups = userchange.UserGroups
 	user.NetworkRoles = userchange.NetworkRoles
-
+	err := ValidateUser(user)
+	if err != nil {
+		return &models.User{}, err
+	}
 	if err := database.DeleteRecord(database.USERS_TABLE_NAME, queryUser); err != nil {
 		return &models.User{}, err
 	}