I have a controller that handles some font-end form validation. From that controller I’d like to require the current (already logged in) user’s password to update any field. How can I do that?

  • Do you mean that you want the user to have an authenticated session to update any field? Or you want them to not only have an authenticated session, but to re-enter their password so you can verify it before updating any field?
    – Brad Bell
    Feb 23, 2016 at 19:00
  • @BradBell re-enter the password to verify. Is that possible?
    – James
    Feb 23, 2016 at 19:59

1 Answer 1


You'd create a Craft plugin with a controller that has an action, say actionSaveForm().

Your controller would look for a password POST variable and if that existed, validate that against the currently logged in user's account to make sure it was a match. If so, continue onto Craft's saveUser or saveEntry, etc. (whatever you're using the form for, otherwise, return a validation error message.

Roughly like this:

public function actionSaveForm()

    $password = craft()->request->getRequiredPost('password');
    {# grab anything else you need from POST #}

    $currentUser = craft()->userSession->getUser();

    if (craft()->users->validatePassword($currentUser->password, $password))
        {# saveEntry, saveUser, etc. then redirect #}

    // Invalid Password
        'error' => "Invalid Password"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.