diff --git a/public/include/pages/password/change.inc.php b/public/include/pages/password/change.inc.php
index 938ed51b..96fd1d40 100644
--- a/public/include/pages/password/change.inc.php
+++ b/public/include/pages/password/change.inc.php
@@ -1,19 +1,19 @@
 <?php
 $defflip = (!cfip()) ? exit(header('HTTP/1.1 401 Unauthorized')) : 1;
 
-if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) {
-  if (isset($_POST['do']) && $_POST['do'] == 'resetPassword') {
+if (isset($_POST['do']) && $_POST['do'] == 'resetPassword') {
+  if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) {
     if ($user->resetPassword($_POST['token'], $_POST['newPassword'], $_POST['newPassword2'])) {
       $_SESSION['POPUP'][] = array('CONTENT' => 'Password reset complete! Please login.', 'TYPE' => 'success');
     } else {
       $_SESSION['POPUP'][] = array('CONTENT' => $user->getError(), 'TYPE' => 'errormsg');
     }
+  } else {
+    $_SESSION['POPUP'][] = array('CONTENT' => $csrftoken->getErrorWithDescriptionHTML(), 'TYPE' => 'info');
   }
-} else {
-  $_SESSION['POPUP'][] = array('CONTENT' => $csrftoken->getErrorWithDescriptionHTML(), 'TYPE' => 'info');
 }
 
 // Tempalte specifics
 $smarty->assign("CONTENT", "default.tpl");
 
-?>
\ No newline at end of file
+?>