On the password reset form the user supplies current_password
, password
and password-confirmation
. Is there a way to specify in the validation rules that current_password
(it's hash value) must match the database value?
Currently I have this:
$rules = array(
'current_password' => 'required',
'password' => 'required|confirmed|min:22'
);
Thank you.
UPDATE
Thanks to @ChrisForrence and @Ben, I came up with the following which works great! Much appreciated. Hope this will help someone else:
Validator::extend('hashmatch', function($attribute, $value, $parameters)
{
return Hash::check($value, Auth::user()->$parameters[0]);
});
$messages = array(
'hashmatch' => 'Your current password must match your account password.'
);
$rules = array(
'current_password' => 'required|hashmatch:password',
'password' => 'required|confirmed|min:4|different:current_password'
);
$validation = Validator::make( Input::all(), $rules, $messages );
The $this->current_password gives us the current_password form field value whereas Laravel allows us to access the currently authenticated user using $this->user() so $this->user()->password gives us the user's hashed password saved in the database. The two passwords are compared using the Hash facade's check method.
To get the exact words to validate you can make use of Rule::in method available with laravel. Using Rule::in method whatever the values provided by this rule has to be matched otherwise it will fail.
Laravel Form Request class comes with two default methods auth() and rules() . You can perform any authorization logic in auth() method whether the current user is allowed to request or not. And in rules() method you can write all your validation rule.
You can't, bcrypt
hashes are unique (they have their own random salt incorporated) so even if you knew the user's plain text password you would't be able do a hash-to-hash comparison.
What you can do is actually check the plain text password against a bcrypt
hash by doing Hash::check('plain text password', 'bcrypt hash')
on your controller.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With