I figure I must need to pass the current user's password along with the updated email address upon form submit. However, I cannot get the email address change to take. Any help is greatly appreciated. Here's my code snippet:

<form action="" method="post" accept-charset="UTF-8" enctype="multipart/form-data" class="account-edit">

    {{ getCsrfInput() }}

    <input type="hidden" name="action" value="users/saveUser">
    <input type="hidden" name="password" value="{{ currentUser.password }}">
    <input type="hidden" name="redirect" value="account">
    <input type="hidden" name="userId" value="{{ currentUser.id }}">
    <input type="hidden" name="deleteUserPhoto" id="deleteUserPhotoInput" value="">

    {% if currentUser.firstName %}
        <div class="form-group">
            <label for="firstName">First Name</label><br>
            <input name="firstName" value="{{ currentUser.firstName }}" class="form-control">
    {% endif %}

    {% if currentUser.lastName %}
        <div class="form-group">
            <label for="lastName">Last Name</label><br>
            <input name="lastName" value="{{ currentUser.lastName }}" class="form-control">
    {% endif %}

    {% if currentUser.email %}
        <div class="form-group">
            <label for="email">Email</label><br>
            <input name="email" value="{{ currentUser.email }}" class="form-control">
    {% endif %}

    {# Check to see if the user has a photo  #}
    {% if currentUser.photoUrl %}
        <label for="userPhoto">Edit Photo</label><br>
        <div class="form-group">
                <div class="cover"></div>
                <img src="{{ currentUser.photoUrl (100) }}" />
                <a href="#" id="deleteUserPhotoAction" class="">Delete</a>
            {# If a photo exists, give the option to change the user photo #}          
            <input type="file" name="userPhoto" value="Change Photo">

    {% else %}

    {# If no photo exists, give the option to upload a new one #}
        <label for="userPhoto">Upload Photo</label><br>
        <div class="form-group">
        <figure><img src="/assets/img/user.gif" /></figure>
            <input type="file" name="userPhoto" value="Upload">
    {% endif %}

    <input type="submit" value="Update Account" class="btn profile-save">

As of Craft 2.3, the rules for changing an existing password are:

If you're editing your existing account OR you're an administrator OR you have the 'changeUserEmails' permission set on your user account, then you need to supply your existing user account's password as a hidden input (not the current password for the account you're trying to change).

<input type="text" id="currentPassword" name="password" />
| improve this answer | |
  • Thanks, Brad. I've tried doing this via a hidden field, but it still will not work. Is this the wrong approach? <input type="hidden" id="currentPassword" name="password" value="{{ currentUser.password }}"> – Herb Himes Jan 27 '15 at 16:16
  • Sorry... forgot the logic around this changed for the 2.3 release. Just updated my answer. – Brad Bell Jan 27 '15 at 17:22
  • @BradBell So there's no option to bypass that requirement? – Mike Pierce Jan 27 '16 at 17:52
  • @HerbHimes That won't work Herb, the password is stored in the DB hashed for security reasons, so when you submit it as a hidden field, it is passing along the hashed version and not your actual password. – Mike Pierce Jan 27 '16 at 17:54
  • @MikePierce correct – Brad Bell Jan 27 '16 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.