<p>Sounds like it might be a form submission issue rather than anything related to password /profile updates. I ran into a similar issue a while ago and resolved it by disabling Suhosin on my server. May want to give that a try.</p>

CC BY-SA 3.0
2016-06-20T17:26:53.323Z
2016-06-20T17:26:53.323Z
Roi Agneta
<p>Typical scenario: users log in on the front-end and have a profile page where they can update their info, including changing their current password.</p>

<p>I have referenced this article from 2014 but it's not working for me; maybe it's outdated by now?</p>

<p><a href="https://craftcms.stackexchange.com/questions/4714/is-it-possible-to-change-a-users-password-in-the-front-end">Is it possible to change a user&#39;s password in the front-end?</a></p>

<p>From that article I get:</p>

<ol>
<li>User needs to be logged in</li>
<li>User needs to submit their current password (input name="password")</li>
<li>User needs to add a new password (input name="newPassword")</li>
</ol>

<p>I've done all of this in my code and it does not work. For simplicity's sake, I've even copied and pasted the code from the link posted above but it does not work. I've created a fake user called "Mister Test" with a password of "purple"; if I try to change the password on the front end to something like "test123", it does not redirect to my success url and does not change the password.</p>

<p>I don't know what else to do. Not much coming up in google searches. My original code is below:</p>

<pre><code>&lt;form method="post" accept-charset="UTF-8"&gt;
    {{ getCsrfInput() }}
    &lt;input type="hidden" name="action" value="users/saveUser"&gt;
    &lt;input type="hidden" name="redirect" value="/"&gt;
    {# redirecting to homepage just for testing #}
    &lt;input type="hidden" name="userId" value="{{ currentUser.id }}"&gt;


    &lt;label for="currentPassword"&gt;{{ "Current password"|t }}&lt;/label&gt;
    &lt;input type="password" name="password" id="currentPassword"&gt;


    &lt;label for="newPassword"&gt;{{ "New password"|t }}&lt;/label&gt;
    &lt;input type="password" name="newPassword" id="newPassword"&gt;


    &lt;button class="btn" type="submit"&gt;{{ "Save"|t }}&lt;/button&gt;
&lt;/form&gt;
</code></pre>

CC BY-SA 3.0
2016-06-20T17:08:27.447Z
For what it is worth, I have a password update feature on one of my sites and it works fine, using the same field names as you. Re: the redirect, since you are using a query parameter, did you create a route to handle the query string?
Roi Agneta
CC BY-SA 3.0
2016-06-20T17:17:22.030Z
The query string doesn't matter. Like I said, at one point I used the code from the article I posted to see if anything in my code was a typo or whatever, and just now I did a test trying to redirect to the homepage but the form simply doesn't submit. The page refreshes but doesn't change the password.
Ryan
CC BY-SA 3.0
2016-06-20T17:42:54.243Z
Is your form checking for errors on the UserModel?  The behavior you're seeing sounds like a validation error is happening.
Brad Bell
CC BY-SA 3.0
2016-06-21T11:08:51.403Z
It's not checking for errors (or not that I know of, at least).  I'm testing with the stripped down code you see above and redirecting to the homepage, but when the form submits, it just refreshes and keeps me on the user profile page with no password change.  Are the names of the inputs listed above correct?  Is there something specific I can search for in the logs? (I'm terrible at reading the logs)
Ryan
CC BY-SA 3.0
2016-06-21T15:51:10.343Z
Oooook, I figured out what's the matter. It's because I'm using this [Craft-Password-Confirm plugin](https://github.com/alecritson/Craft-Password-Confirm) to ensure the right password gets submitted on registration.  However, the plugin is set to always check an input with a name of "confirmPassword" against another input called "password". In this case, however, since it's an _update password_ form, I have both of those fields plus the "newPassword" field.
Ryan
CC BY-SA 3.0
2016-06-21T15:51:14.390Z
I originally deleted the "confirmPassword" field out of my form because I knew it would be checking against the current password and not the new password, as would make sense, but the absence of that field still causes a validation error as @BradBell suspected, except nothing was in the code to notify me about the error.  I either have to get the developer to update their plugin, hack it myself, or delete it from my system in order for this to work.  Anyway, thanks for the help, everybody.  I spent too much time trying to debug this problem :(
Ryan
<frontend><user-profile><password>
Front end user profile: update password
# Front end user profile: update password

(Asked by: username_0 on 2016-06-20)

Typical scenario: users log in on the front-end and have a profile page where they can update their info, including changing their current password.
I have referenced this article from 2014 but it's not working for me; maybe it's outdated by now?
Is it possible to change a user's password in the front-end?
From that article I get:

User needs to be logged in
User needs to submit their current password (input name="password")
User needs to add a new password (input name="newPassword")

I've done all of this in my code and it does not work. For simplicity's sake, I've even copied and pasted the code from the link posted above but it does not work. I've created a fake user called "Mister Test" with a password of "purple"; if I try to change the password on the front end to something like "test123", it does not redirect to my success url and does not change the password.
I don't know what else to do. Not much coming up in google searches. My original code is below:

    {{ getCsrfInput() }}
    
    
    {# redirecting to homepage just for testing #}
    


    {{ "Current password"|t }}
    


    {{ "New password"|t }}
    


    {{ "Save"|t }}

**Tags:** frontend, user-profile, password

> **Comments:**
> **username_1**: For what it is worth, I have a password update feature on one of my sites and it works fine, using the same field names as you. Re: the redirect, since you are using a query parameter, did you create a route to handle the query string?  
> **username_0**: The query string doesn't matter. Like I said, at one point I used the code from the article I posted to see if anything in my code was a typo or whatever, and just now I did a test trying to redirect to the homepage but the form simply doesn't submit. The page refreshes but doesn't change the password.  
> **username_2**: Is your form checking for errors on the UserModel?  The behavior you're seeing sounds like a validation error is happening.  
> **username_0**: It's not checking for errors (or not that I know of, at least).  I'm testing with the stripped down code you see above and redirecting to the homepage, but when the form submits, it just refreshes and keeps me on the user profile page with no password change.  Are the names of the inputs listed above correct?  Is there something specific I can search for in the logs? (I'm terrible at reading the logs)  
> **username_0**: Oooook, I figured out what's the matter. It's because I'm using this [Craft-Password-Confirm plugin](https://github.com/alecritson/Craft-Password-Confirm) to ensure the right password gets submitted on registration.  However, the plugin is set to always check an input with a name of "confirmPassword" against another input called "password". In this case, however, since it's an _update password_ form, I have both of those fields plus the "newPassword" field.  
> **username_0**: I originally deleted the "confirmPassword" field out of my form because I knew it would be checking against the current password and not the new password, as would make sense, but the absence of that field still causes a validation error as @BradBell suspected, except nothing was in the code to notify me about the error.  I either have to get the developer to update their plugin, hack it myself, or delete it from my system in order for this to work.  Anyway, thanks for the help, everybody.  I spent too much time trying to debug this problem :(  

---

## 1 answers

### Answer by username_1 on 2016-06-20. Score: 1

Sounds like it might be a form submission issue rather than anything related to password /profile updates. I ran into a similar issue a while ago and resolved it by disabling Suhosin on my server. May want to give that a try.


---

