public class GHI_Portal_Password_Controller {

    public Boolean hasNewPassword { get; set; }
    public Boolean hasSecurity { get;set; }
    public Boolean isReset {get;set;}
    public Boolean hasConfirmPassword { get; set; }

    public String newPassword { get; set; }
    public String confirmPassword { get; set; }
    public String passwordMsg { get; set; }
    public String securityError { get; set; }

    public String charAllowed { get; set; }

    public User currentUser { get; set; }
    public Boolean passwordMatch{get;set;}


    public GHI_Portal_Password_Controller(){
        this.charAllowed = Label.GHI_Portal_AllowedChar;
        this.hasConfirmPassword = true;
        this.hasNewPassword = true;
        passwordMsg = '';
        passwordMatch= false;
        currentUser = [Select GHI_Portal_Security_Question_1__c,GHI_Portal_Security_Question_2__c,GHI_Portal_Security_Question_3__c,
                                GHI_Portal_Answer_1__c,GHI_Portal_Answer_2__c, GHI_Portal_Answer_3__c from User where Id = :UserInfo.getUserId()];

        // system.debug('@@currentUser.GHI_Portal_Security_Question_1__c '+currentUser.GHI_Portal_Security_Question_1__c);
        if ((currentUser.GHI_Portal_Security_Question_1__c != null && currentUser.GHI_Portal_Security_Question_1__c != '') &&
            (currentUser.GHI_Portal_Security_Question_2__c != null && currentUser.GHI_Portal_Security_Question_2__c != '') &&
            (currentUser.GHI_Portal_Security_Question_3__c != null && currentUser.GHI_Portal_Security_Question_3__c != '') &&
            (currentUser.GHI_Portal_Answer_1__c != null && currentUser.GHI_Portal_Answer_1__c != '') &&
            (currentUser.GHI_Portal_Answer_2__c != null && currentUser.GHI_Portal_Answer_2__c != '') &&
            (currentUser.GHI_Portal_Answer_3__c != null && currentUser.GHI_Portal_Answer_3__c != ''))
            {
            isReset = false;
        }
        else{
            isReset = true;
        }
    }


    public PageReference changePasswordPage() {
    PageReference prSiteChangePass;
    this.passwordMsg='';


            if (currentUser.GHI_Portal_Security_Question_1__c == null || currentUser.GHI_Portal_Answer_1__c==null ||
                currentUser.GHI_Portal_Security_Question_2__c == null || currentUser.GHI_Portal_Answer_2__c==null ||
                currentUser.GHI_Portal_Security_Question_3__c == null || currentUser.GHI_Portal_Answer_3__c==null) {
                hasSecurity = true;
                this.securityError = Label.GHI_Portal_SecurityError;
            }
            **else if(newPassword.length() > 20 || confirmPassword.length() > 20) {
                    this.passwordMsg = Label.GHI_Portal_PasswordMsg;
                    passwordMatch = true;**
                    //return ApexPages.currentPage();
            }
            **else if (newPassword.contains(' ')) {
                this.passwordMsg = Label.GHI_Portal_PasswordMsg;**
                //System.debug('@@passwordMsg2 ' + passwordMsg);
                **passwordMatch = true;**
                //return ApexPages.currentPage();
            }
            **else if (currentUser.GHI_Portal_Security_Question_1__c == currentUser.GHI_Portal_Security_Question_2__c ||**
                        currentUser.GHI_Portal_Security_Question_2__c == currentUser.GHI_Portal_Security_Question_3__c ||
                        currentUser.GHI_Portal_Security_Question_1__c == currentUser.GHI_Portal_Security_Question_3__c) {
                        **hasSecurity = true;
                this.securityError = Label.GHI_Portal_UniqueQuestionMsg;**
            }
            else{
                **update currentUser;
                prSiteChangePass = Site.changePassword(newPassword, confirmPassword);
                return ((hasNewPassword && hasConfirmPassword) ? prSiteChangePass : ApexPages.currentPage());**
            }
            return ApexPages.currentPage();
    }
}

@isTest
private class GHI_Portal_Password_Controller_Test {

    private static testMethod void test() {

    }
    private static testMethod void testLogin() {
        GHI_Portal_Password_Controller controller1 = new GHI_Portal_Password_Controller();
        User testUser = new User();
        testUser.Username= 'testUser11@company.com';
        testUser.Email = 'testuser1@company.com';
        testUser.Lastname = 'user';
        testUser.Firstname = 'test';
        testUser.Alias = 'test';
        testUser.CommunityNickname = '12346test';
        List<Profile> prof = [select Id from Profile where Name = 'System Administrator' LIMIT 1];
        List<UserRole> role =  [select Id from UserRole where Name = 'finance'];
        testUser.UserRoleId = role[0].Id;
        testUser.ProfileId = prof[0].Id;

        //testUser.CurrencyIsoCode = 'USD';
        testUser.TimeZoneSidKey = 'GMT';
        testUser.LocaleSidKey = 'en_US';
        testUser.EmailEncodingKey = 'ISO-8859-1';

        testUser.LanguageLocaleKey = 'en_US';
        testUser.UserPermissionsMobileUser = false;
        insert testUser;

        PageReference pageRef = Page.GHI_Portal_Login;
        pageRef.getParameters().put('A','1');
        GHI_Portal_Login controller = new GHI_Portal_Login();
        Test.setCurrentPage(pageRef);

        Test.startTest();
        System.runAs(testUser) {
            RecordType rtContact = [SELECT Id FROM RecordType WHERE SObjectType='Contact' AND Name='Patient' LIMIT 1];
            Account acct = OSM_DataFactory.createAccount('test test');
            insert acct;
            Contact ctct = OSM_DataFactory.createContact('test','test',rtContact.Id);
            ctct.AccountId = acct.Id;
            insert ctct;

            User user = new User();
            user.Username= 'testUser1@company.com';
            user.Email = 'testuser1@company.com';
            user.Lastname = 'user';
            user.Firstname = 'test';
            user.Alias = 'test';
            user.CommunityNickname = '12346';
            List<Profile> prof1 = [select Id from Profile where Name = 'GHI Portal User' LIMIT 1];
            user.ProfileId = prof1[0].Id;
            user.ContactId = ctct.Id;

            //testUser.CurrencyIsoCode = 'USD';
            user.TimeZoneSidKey = 'GMT';
            user.LocaleSidKey = 'en_US';
            user.EmailEncodingKey = 'ISO-8859-1';
            user.LanguageLocaleKey = 'en_US';
            user.UserPermissionsMobileUser = false;
            user.GHI_Portal_Security_Question_1__c ='';
            user.GHI_Portal_Security_Question_2__c ='';
            user.GHI_Portal_Security_Question_3__c ='';
            user.GHI_Portal_Answer_3__c = '';
            insert user;
            controller1.changePasswordPage();
            controller1.newPassword = 'dsadsadsada';
            controller1.confirmPassword = 'dsadadasda';
            update user;
            update testUser;
            update acct;
            update ctct;
            Test.stopTest();

        }
    }
}

controller1.changePasswordPage();

// Set your values in these fields so it doesn't go in the first IF statement
testUser.GHI_Portal_Security_Question_1__c = 'Test';
testUser.GHI_Portal_Security_Question_2__c = 'Test';
testUser.GHI_Portal_Security_Question_3__c = 'Test';
testUser.GHI_Portal_Answer_1__c = 'Test';
testUser.GHI_Portal_Answer_2__c = 'Test';
testUser.GHI_Portal_Answer_3__c = 'Test';
update testUser;
controller1 = new GHI_Portal_Password_Controller(); // re-initialise the controller in order to get the field values in the user variable
// Also set newPassword and confirmPassword with length > 20 so that it executes the 2nd else-if block
controller1.newPassword = '1234567890123456789012345';
controller1.confirmPassword = '1234567890123456789012345';
controller1.changePasswordPage(); // Call again this method, this time it should skip the first IF statement since it evaluates to false
// Let's now change the passwords again so that it doesn't go in the 2nd but goes in the 3rd else-if (means we have to have whitespace in the password)
controller1.newPassword = 'a b';
controller1.confirmPassword = 'a b';
controller1.changePasswordPage();
// Reset all this again so that all first 3 if/else-if blocks are skipped (< 20 characters and no whitespace)
controller1.newPassword = 'abc';
controller1.confirmPassword = 'abc';
controller1.changePasswordPage();
// Update the question/answer values again just like for the 1st if statement, but make sure they all have different values so that your last else if is covered