Change password without the old password about php-auth HOT 7 CLOSED

Thanks!

Do you want to do this as a user (i.e. let the user do this on their own) or as an administrator?

For the first case, the decision to require the old password as well has been intentional. But perhaps there might be some use cases where this is not required.

from php-auth.

Hi ocram,

Yes, I want to do this as a user.

I've seen the function updatePassword inside Auth.php :)

from php-auth.

Will be available shortly, using a small wrapper around updatePassword. Thanks!

from php-auth.

I wasn't sure if this would be secure? but isn't password update a sensitive access? What if someone use rememberme by mistake on a public computer and somebody change the password without needing to input the old password?

from php-auth.

But as an admin it sound logical.

from php-auth.

@fdiengdoh You're absolutely right. That's why the current method for changing the password still requires the old password to be entered. With the new method added, the old one will still be the recommended one and the default.

from php-auth.

Implemented in:

• 1800525
• 62c5fab
• 7272fbb
• 91f50a8

This is available in a new major version, v6.0.0, which comes with a few breaking changes. For a guide on how to upgrade, please see the migration notes in Migration.md.

from php-auth.