package vu.de.npolke.myexpenses.servlets;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import vu.de.npolke.myexpenses.model.Account;
import vu.de.npolke.myexpenses.services.AccountDAO;
import vu.de.npolke.myexpenses.services.DAOFactory;
import vu.de.npolke.myexpenses.servlets.util.ServletReaction;
import vu.de.npolke.myexpenses.util.HashUtil;

/**
 * Copyright 2015 Niklas Polke
 *
 * Licensed under the Apache License, Version 2.0 (the "License"); you may not
 * use this file except in compliance with the License. You may obtain a copy of
 * the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 * License for the specific language governing permissions and limitations under
 * the License.
 *
 * @author Niklas Polke
 */
@WebServlet("/editaccount")
public class EditAccountServlet extends AbstractBasicServlet {

	private static final long serialVersionUID = 1L;

	AccountDAO accountDAO = (AccountDAO) DAOFactory.getDAO(Account.class);

	@Override
	protected ServletReaction doGet(final HttpServletRequest request, final HttpServletResponse response,
			final HttpSession session, Account account) throws ServletException, IOException {

		return prepareEditAccount(account);
	}

	public ServletReaction prepareEditAccount(final Account account) {
		ServletReaction reaction = new ServletReaction();
		reaction.setRedirect("editaccount.jsp");
		reaction.setSessionAttribute("account", account);
		return reaction;
	}

	@Override
	public ServletReaction doPost(final HttpServletRequest request, final HttpServletResponse response,
			final HttpSession session, Account account) throws ServletException, IOException {

		final String oldpassword = request.getParameter("oldpassword");
		final String newpassword1 = request.getParameter("newpassword1");
		final String newpassword2 = request.getParameter("newpassword2");

		return editAccount(account, oldpassword, newpassword1, newpassword2);
	}

	public ServletReaction editAccount(final Account account, final String oldPassword, final String newPassword1,
			final String newPassword2) {
		ServletReaction reaction = new ServletReaction();
		if (!account.getPassword().equals(HashUtil.toMD5(oldPassword))) {
			handleIncorrectInput(reaction, "oldpassword wasn't correct");
		} else if (newPassword1 != null && newPassword1.trim().length() > 3 && newPassword1.equals(newPassword2)) {
			account.setPassword(HashUtil.toMD5(newPassword1));
			accountDAO.update(account);
			reaction.setRedirect("listexpenses");
		} else {
			handleIncorrectInput(reaction, "password1 wasn't equal to password2");
		}

		return reaction;
	}

	private void handleIncorrectInput(final ServletReaction reaction, final String errorMessage) {
		reaction.setRequestAttribute("errorMessage", errorMessage);
		reaction.setForward("editaccount.jsp");
	}
}

package vu.de.npolke.myexpenses.servlets;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import vu.de.npolke.myexpenses.model.Account;
import vu.de.npolke.myexpenses.services.AccountDAO;
import vu.de.npolke.myexpenses.services.DAOFactory;
import vu.de.npolke.myexpenses.servlets.util.ServletReaction;
import vu.de.npolke.myexpenses.util.HashUtil;

/**
 * Copyright 2015 Niklas Polke
 *
 * Licensed under the Apache License, Version 2.0 (the "License"); you may not
 * use this file except in compliance with the License. You may obtain a copy of
 * the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 * License for the specific language governing permissions and limitations under
 * the License.
 *
 * @author Niklas Polke
 */
@WebServlet("/editaccount")
public class EditAccountServlet extends AbstractBasicServlet {

	private static final long serialVersionUID = 1L;

	AccountDAO accountDAO = (AccountDAO) DAOFactory.getDAO(Account.class);

	@Override
	protected ServletReaction doGet(final HttpServletRequest request, final HttpServletResponse response,
			final HttpSession session, Account account) throws ServletException, IOException {

		return prepareEditAccount(account);
	}

	public ServletReaction prepareEditAccount(final Account account) {
		ServletReaction reaction = new ServletReaction();
		reaction.setRedirect("editaccount.jsp");
		reaction.setSessionAttribute("account", account);
		return reaction;
	}

	@Override
	public ServletReaction doPost(final HttpServletRequest request, final HttpServletResponse response,
			final HttpSession session, Account account) throws ServletException, IOException {

		final String oldpassword = request.getParameter("oldpassword");
		final String newpassword1 = request.getParameter("newpassword1");
		final String newpassword2 = request.getParameter("newpassword2");

		return editAccount(account, oldpassword, newpassword1, newpassword2);
	}

	public ServletReaction editAccount(final Account account, final String oldPassword, final String newPassword1,
			final String newPassword2) {
		ServletReaction reaction = new ServletReaction();
		if (!account.getPassword().equals(HashUtil.toMD5(oldPassword))) {
			handleIncorrectInput(reaction, "old password wasn't correct");
		} else if (newPassword1 != null && newPassword1.trim().length() > 3 && newPassword1.equals(newPassword2)) {
			account.setPassword(HashUtil.toMD5(newPassword1));
			accountDAO.update(account);
			reaction.setRedirect("listexpenses");
		} else {
			handleIncorrectInput(reaction, "new password 1 wasn't equal to new password 2");
		}

		return reaction;
	}

	private void handleIncorrectInput(final ServletReaction reaction, final String errorMessage) {
		reaction.setRequestAttribute("errorMessage", errorMessage);
		reaction.setForward("editaccount.jsp");
	}
}

Change error message