<p>As of Craft 2.3, the rules for changing an existing password are:</p>

<p>If you're editing your existing account OR you're an administrator OR you have the 'changeUserEmails' permission set on your user account, then you need to supply <em>your</em> existing user account's password as a hidden input (not the current password for the account you're trying to change).</p>

<pre class="lang-html prettyprint-override"><code>&lt;input type="text" id="currentPassword" name="password" /&gt;
</code></pre>

CC BY-SA 3.0
2015-01-27T16:16:18.470Z
Thanks, Brad. I've tried doing this via a hidden field, but it still will not work. Is this the wrong approach?
`<input type="hidden" id="currentPassword" name="password" value="{{ currentUser.password }}">`
Herb Himes
CC BY-SA 3.0
2015-01-27T17:22:49.273Z
Sorry... forgot the logic around this changed for the 2.3 release.  Just updated my answer.
Brad Bell
CC BY-SA 3.0
2016-01-27T17:52:52.000Z
@BradBell So there's no option to bypass that requirement?
Mike Pierce
CC BY-SA 3.0
2016-01-27T17:54:26.333Z
@HerbHimes That won't work Herb, the password is stored in the DB hashed for security reasons, so when you submit it as a hidden field, it is passing along the hashed version and not your actual password.
Mike Pierce
CC BY-SA 3.0
2016-01-27T20:11:40.533Z
@MikePierce correct
Brad Bell
CC BY-SA 3.0
2015-01-27T03:24:32.370Z
2017-12-04T18:38:22.973Z
2017-12-04T18:38:22.973Z
Brad Bell
<p>I figure I must need to pass the current user's password along with the updated email address upon form submit. However, I cannot get the email address change to take. Any help is greatly appreciated. Here's my code snippet:</p>

<pre class="lang-html prettyprint-override"><code>&lt;form action="" method="post" accept-charset="UTF-8" enctype="multipart/form-data" class="account-edit"&gt;

    {{ getCsrfInput() }}

    &lt;input type="hidden" name="action" value="users/saveUser"&gt;
    &lt;input type="hidden" name="password" value="{{ currentUser.password }}"&gt;
    &lt;input type="hidden" name="redirect" value="account"&gt;
    &lt;input type="hidden" name="userId" value="{{ currentUser.id }}"&gt;
    &lt;input type="hidden" name="deleteUserPhoto" id="deleteUserPhotoInput" value=""&gt;

    {% if currentUser.firstName %}
        &lt;div class="form-group"&gt;
            &lt;label for="firstName"&gt;First Name&lt;/label&gt;&lt;br&gt;
            &lt;input name="firstName" value="{{ currentUser.firstName }}" class="form-control"&gt;
        &lt;/div&gt;
    {% endif %}

    {% if currentUser.lastName %}
        &lt;div class="form-group"&gt;
            &lt;label for="lastName"&gt;Last Name&lt;/label&gt;&lt;br&gt;
            &lt;input name="lastName" value="{{ currentUser.lastName }}" class="form-control"&gt;
        &lt;/div&gt;
    {% endif %}

    {% if currentUser.email %}
        &lt;div class="form-group"&gt;
            &lt;label for="email"&gt;Email&lt;/label&gt;&lt;br&gt;
            &lt;input name="email" value="{{ currentUser.email }}" class="form-control"&gt;
        &lt;/div&gt;
    {% endif %}

    {# Check to see if the user has a photo  #}
    {% if currentUser.photoUrl %}
        &lt;label for="userPhoto"&gt;Edit Photo&lt;/label&gt;&lt;br&gt;
        &lt;div class="form-group"&gt;
            &lt;figure&gt;
                &lt;div class="cover"&gt;&lt;/div&gt;
                &lt;img src="{{ currentUser.photoUrl (100) }}" /&gt;
                &lt;a href="#" id="deleteUserPhotoAction" class=""&gt;Delete&lt;/a&gt;
            &lt;/figure&gt;
            {# If a photo exists, give the option to change the user photo #}          
            &lt;input type="file" name="userPhoto" value="Change Photo"&gt;

        &lt;/div&gt;
    {% else %}

    {# If no photo exists, give the option to upload a new one #}
        &lt;label for="userPhoto"&gt;Upload Photo&lt;/label&gt;&lt;br&gt;
        &lt;div class="form-group"&gt;
        &lt;figure&gt;&lt;img src="/assets/img/user.gif" /&gt;&lt;/figure&gt;
            &lt;input type="file" name="userPhoto" value="Upload"&gt;
        &lt;/div&gt;
    {% endif %}


    &lt;input type="submit" value="Update Account" class="btn profile-save"&gt;
&lt;/form&gt;
</code></pre>

<frontend><usermodel>
I cannot get the email address to properly update from my user account management form
# I cannot get the email address to properly update from my user account management form

(Asked by: username_0 on 2015-01-27)

I figure I must need to pass the current user's password along with the updated email address upon form submit. However, I cannot get the email address change to take. Any help is greatly appreciated. Here's my code snippet:


    {{ getCsrfInput() }}

    
    
    
    
    

    {% if currentUser.firstName %}
        
            First Name
            
        
    {% endif %}

    {% if currentUser.lastName %}
        
            Last Name
            
        
    {% endif %}

    {% if currentUser.email %}
        
            Email
            
        
    {% endif %}

    {# Check to see if the user has a photo  #}
    {% if currentUser.photoUrl %}
        Edit Photo
        
            
                
                
                Delete
            
            {# If a photo exists, give the option to change the user photo #}          
            

        
    {% else %}

    {# If no photo exists, give the option to upload a new one #}
        Upload Photo
        
        
            
        
    {% endif %}

**Tags:** frontend, usermodel

---

## 1 answers

### Answer by username_1 on 2015-01-27. Score: 3

As of Craft 2.3, the rules for changing an existing password are:
If you're editing your existing account OR you're an administrator OR you have the 'changeUserEmails' permission set on your user account, then you need to supply your existing user account's password as a hidden input (not the current password for the account you're trying to change).

> **Comments:**
> **username_0**: Thanks, Brad. I've tried doing this via a hidden field, but it still will not work. Is this the wrong approach? `<input type="hidden" id="currentPassword" name="password" value="{{ currentUser.password }}">`  
> **username_1**: Sorry... forgot the logic around this changed for the 2.3 release.  Just updated my answer.  
> **username_2**: @BradBell So there's no option to bypass that requirement?  
> **username_2**: @HerbHimes That won't work Herb, the password is stored in the DB hashed for security reasons, so when you submit it as a hidden field, it is passing along the hashed version and not your actual password.  
> **username_1**: @MikePierce correct  

---

