I have a controller that handles some font-end form validation. From that controller I’d like to require the current (already logged in) user’s password to update any field. How can I do that?
1
-
Do you mean that you want the user to have an authenticated session to update any field? Or you want them to not only have an authenticated session, but to re-enter their password so you can verify it before updating any field? – Brad Bell Feb 23 '16 at 19:00
-
@BradBell re-enter the password to verify. Is that possible? – James Feb 23 '16 at 19:59
2
You'd create a Craft plugin with a controller that has an action, say actionSaveForm().
Your controller would look for a password POST variable and if that existed, validate that against the currently logged in user's account to make sure it was a match. If so, continue onto Craft's saveUser or saveEntry, etc. (whatever you're using the form for, otherwise, return a validation error message.
Roughly like this:
public function actionSaveForm()
{
$this->requirePostRequest();
craft()->userSession->requireLogin();
$password = craft()->request->getRequiredPost('password');
{# grab anything else you need from POST #}
$currentUser = craft()->userSession->getUser();
if (craft()->users->validatePassword($currentUser->password, $password))
{
{# saveEntry, saveUser, etc. then redirect #}
}
// Invalid Password
craft()->urlManager->setRouteVariables(array(
'error' => "Invalid Password"
));
}
