restrict to team even if malicious POST edit

kfet/views.py

@@ -473,7 +473,8 @@ def account_update(request, trigramme):
                 messages.success(request,
                                  'Vos informations ont été mises à jour')
 
-                if pwd_form.is_valid():
+                if request.user.has_perm('kfet.is_team') \
+                        and pwd_form.is_valid():
                     pwd = pwd_form.cleaned_data['pwd1']
                     pwd_sha256 = hashlib.sha256(pwd.encode('utf-8'))\
                                         .hexdigest()