<p>If the user already has an elevated session then they do not need to enter their current password. You can see the relevant code for this check here:
<a href="https://github.com/craftcms/cms/blob/bd3820f19a0680c635a89c7f16805299964d97f2/src/controllers/UsersController.php#L1713-L1721" rel="nofollow noreferrer">https://github.com/craftcms/cms/blob/bd3820f19a0680c635a89c7f16805299964d97f2/src/controllers/UsersController.php#L1713-L1721</a></p>
<p>That is the only explanation I can come up with for the difference in what you are seeing locally and in production.</p>

CC BY-SA 4.0
2021-05-12T16:07:45.237Z
2021-05-12T16:07:45.237Z
Ben Croker
<p>I'm adding an update password form. This is not a reset password in case of a forgotten pw, but a form that allows users to update at their leisure. I have the current password field <code>name=&quot;currentPassword&quot;</code> and the new password field <code>name=&quot;newPassword&quot;</code>.</p>
<p>When I run the form locally, it works as expected, and does not save the user when the currentPassword value is incorrect. When I run it on our production site, the current password field accepts any value at all, still saves, and changes the password to the new password value despite the current password not being correct. Is there some environment setting I could be missing here that's responsible for this?</p>
<p>Running Craft 3.4.30, no Commerce.</p>

<craft3><password>
Password Update form accepting any data for currentPassword
# Password Update form accepting any data for currentPassword

(Asked by: username_0 on 2021-05-11)

I'm adding an update password form. This is not a reset password in case of a forgotten pw, but a form that allows users to update at their leisure. I have the current password field `name="currentPassword"` and the new password field `name="newPassword"`.

When I run the form locally, it works as expected, and does not save the user when the currentPassword value is incorrect. When I run it on our production site, the current password field accepts any value at all, still saves, and changes the password to the new password value despite the current password not being correct. Is there some environment setting I could be missing here that's responsible for this?

Running Craft 3.4.30, no Commerce.

**Tags:** craft3, password

---

## 1 answers

### Answer by username_1 on 2021-05-12. Score: 1 | Accepted answer

If the user already has an elevated session then they do not need to enter their current password. You can see the relevant code for this check here:
<https://github.com/craftcms/cms/blob/bd3820f19a0680c635a89c7f16805299964d97f2/src/controllers/UsersController.php#L1713-L1721>

That is the only explanation I can come up with for the difference in what you are seeing locally and in production.


---

