1

I have a controller that handles some font-end form validation. From that controller I’d like to require the current (already logged in) user’s password to update any field. How can I do that?

  • Do you mean that you want the user to have an authenticated session to update any field? Or you want them to not only have an authenticated session, but to re-enter their password so you can verify it before updating any field? – Brad Bell Feb 23 '16 at 19:00
  • @BradBell re-enter the password to verify. Is that possible? – James Feb 23 '16 at 19:59
2

You'd create a Craft plugin with a controller that has an action, say actionSaveForm().

Your controller would look for a password POST variable and if that existed, validate that against the currently logged in user's account to make sure it was a match. If so, continue onto Craft's saveUser or saveEntry, etc. (whatever you're using the form for, otherwise, return a validation error message.

Roughly like this:

public function actionSaveForm()
{
    $this->requirePostRequest();
    craft()->userSession->requireLogin();

    $password = craft()->request->getRequiredPost('password');
    {# grab anything else you need from POST #}

    $currentUser = craft()->userSession->getUser();

    if (craft()->users->validatePassword($currentUser->password, $password))
    {
        {# saveEntry, saveUser, etc. then redirect #}
    }

    // Invalid Password
    craft()->urlManager->setRouteVariables(array(
        'error' => "Invalid Password"
    ));
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.