Require password from current user on front-end form?

Question

I have a controller that handles some font-end form validation. From that controller I’d like to require the current (already logged in) user’s password to update any field. How can I do that?

Answer 1

You'd create a Craft plugin with a controller that has an action, say actionSaveForm().

Your controller would look for a password POST variable and if that existed, validate that against the currently logged in user's account to make sure it was a match. If so, continue onto Craft's saveUser or saveEntry, etc. (whatever you're using the form for, otherwise, return a validation error message.

Roughly like this:

public function actionSaveForm()
{
    $this->requirePostRequest();
    craft()->userSession->requireLogin();

    $password = craft()->request->getRequiredPost('password');
    {# grab anything else you need from POST #}

    $currentUser = craft()->userSession->getUser();

    if (craft()->users->validatePassword($currentUser->password, $password))
    {
        {# saveEntry, saveUser, etc. then redirect #}
    }

    // Invalid Password
    craft()->urlManager->setRouteVariables(array(
        'error' => "Invalid Password"
    ));
}