<p>You'd create a Craft <a href="https://craftcms.com/docs/plugins" rel="nofollow">plugin</a> with a <a href="https://craftcms.com/docs/plugins/controllers" rel="nofollow">controller</a> that has an <a href="https://craftcms.com/docs/plugins/controllers#posting-to-controller-actions" rel="nofollow">action</a>, say <code>actionSaveForm()</code>.</p>

<p>Your controller would look for a <code>password</code> POST variable and if that existed, validate that against the currently logged in user's account to make sure it was a match.  If so, continue onto Craft's <code>saveUser</code> or <code>saveEntry</code>, etc. (whatever you're using the form for, otherwise, return a validation error message.</p>

<p>Roughly like this:</p>

<pre><code>public function actionSaveForm()
{
    $this-&gt;requirePostRequest();
    craft()-&gt;userSession-&gt;requireLogin();

    $password = craft()-&gt;request-&gt;getRequiredPost('password');
    {# grab anything else you need from POST #}

    $currentUser = craft()-&gt;userSession-&gt;getUser();

    if (craft()-&gt;users-&gt;validatePassword($currentUser-&gt;password, $password))
    {
        {# saveEntry, saveUser, etc. then redirect #}
    }

    // Invalid Password
    craft()-&gt;urlManager-&gt;setRouteVariables(array(
        'error' =&gt; "Invalid Password"
    ));
}
</code></pre>

CC BY-SA 3.0
2016-02-23T22:12:17.673Z
2016-02-23T22:12:17.673Z
Brad Bell
<p>I have a controller that handles some font-end form validation. From that controller I’d like to require the current (already logged in) user’s password to update any field. How can I do that?</p>

CC BY-SA 3.0
2016-02-23T19:00:05.947Z
Do you mean that you want the user to have an authenticated session to update any field?  Or you want them to not only have an authenticated session, but to re-enter their password so you can verify it before updating any field?
Brad Bell
CC BY-SA 3.0
2016-02-23T19:59:57.900Z
@BradBell re-enter the password to verify. Is that possible?
James
<plugin-development><users><plugins><password><usermodel>
Require password from current user on front-end form?
# Require password from current user on front-end form?

(Asked by: username_0 on 2016-02-23)

I have a controller that handles some font-end form validation. From that controller I’d like to require the current (already logged in) user’s password to update any field. How can I do that?

**Tags:** plugin-development, users, plugins, password, usermodel
> **Comments:**
> **username_1**: Do you mean that you want the user to have an authenticated session to update any field?  Or you want them to not only have an authenticated session, but to re-enter their password so you can verify it before updating any field?  
> **username_0**: @BradBell re-enter the password to verify. Is that possible?  

---

## 1 answers

### Answer by username_1 on 2016-02-23. Score: 2 | Accepted answer

You'd create a Craft plugin with a controller that has an action, say actionSaveForm().
Your controller would look for a password POST variable and if that existed, validate that against the currently logged in user's account to make sure it was a match.  If so, continue onto Craft's saveUser or saveEntry, etc. (whatever you're using the form for, otherwise, return a validation error message.
Roughly like this:
public function actionSaveForm()
{
    $this->requirePostRequest();
    craft()->userSession->requireLogin();

    $password = craft()->request->getRequiredPost('password');
    {# grab anything else you need from POST #}

    $currentUser = craft()->userSession->getUser();

    if (craft()->users->validatePassword($currentUser->password, $password))
    {
        {# saveEntry, saveUser, etc. then redirect #}
    }

    // Invalid Password
    craft()->urlManager->setRouteVariables(array(
        'error' => "Invalid Password"
    ));
}


---

