--- form from changepass.rhtml ---
<% form_for :user, :action => :changepass, :method => :post do %>
  <h3>Change your password</h3>
    <fieldset>
      <%=@err %>
	<%=error_messages_for 'user' %>
	<label class="field-password">Current Password &#42;
	  <input type="password" name="currpass" value="">
	</label>
	<label class="field-password">New Password &#42;
	  <%= password_field "user" , "password" %>
	</label>
	<label class="field-password">Confirm Password &#42;
	  <%= password_field "user" , "password_confirmation" %>
	</label>
	<label class="field-submit">
  	  <input type="submit" class="half_right" value="Submit">
	</label>
    <fieldset>
<% end %>
--- end form from changepass.rhtml ---

-- action for this form --
  def changepass
    return unless request.post?
      user = User.find(self.current_user.id)
      if user.authenticated?(params[:currpass])
        user.crypted_password = user.encrypt(params[:passwd])
        user.save
        flash[:note] = "Password updated successfully"
        redirect_to :action => 'index'
      else
        flash[:note] = 'Wrong current password'
        redirect_to :action => 'changepass'
      end
  end