Answers.Body: <p>You'd create a Craft <a href="https://craftcms.com/docs/plugins" rel="nofollow">plugin</a> with a <a href="https://craftcms.com/docs/plugins/controllers" rel="nofollow">controller</a> that has an <a href="https://craftcms.com/docs/plugins/controllers#posting-to-controller-actions" rel="nofollow">action</a>, say <code>actionSaveForm()</code>.</p>
  
  <p>Your controller would look for a <code>password</code> POST variable and if that existed, validate that against the currently logged in user's account to make sure it was a match.  If so, continue onto Craft's <code>saveUser</code> or <code>saveEntry</code>, etc. (whatever you're using the form for, otherwise, return a validation error message.</p>
  
  <p>Roughly like this:</p>
  
  <pre><code>public function actionSaveForm()
  {
      $this-&gt;requirePostRequest();
      craft()-&gt;userSession-&gt;requireLogin();
  
      $password = craft()-&gt;request-&gt;getRequiredPost('password');
      {# grab anything else you need from POST #}
  
      $currentUser = craft()-&gt;userSession-&gt;getUser();
  
      if (craft()-&gt;users-&gt;validatePassword($currentUser-&gt;password, $password))
      {
          {# saveEntry, saveUser, etc. then redirect #}
      }
  
      // Invalid Password
      craft()-&gt;urlManager-&gt;setRouteVariables(array(
          'error' =&gt; "Invalid Password"
      ));
  }
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-02-23T22:12:17.673Z
Answers.LastActivityDate: 2016-02-23T22:12:17.673Z
Answers.UserDisplayName: Brad Bell
Body: <p>I have a controller that handles some font-end form validation. From that controller I’d like to require the current (already logged in) user’s password to update any field. How can I do that?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-02-23T19:00:05.947Z
Comments.Text: Do you mean that you want the user to have an authenticated session to update any field?  Or you want them to not only have an authenticated session, but to re-enter their password so you can verify it before updating any field?
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-02-23T19:59:57.900Z
Comments.Text: @BradBell re-enter the password to verify. Is that possible?
Comments.UserDisplayName: James
Tags: <plugin-development><users><plugins><password><usermodel>
Title: Require password from current user on front-end form?
ThreadText: # Require password from current user on front-end form?
  
  (Asked by: username_0 on 2016-02-23)
  
  I have a controller that handles some font-end form validation. From that controller I’d like to require the current (already logged in) user’s password to update any field. How can I do that?
  
  **Tags:** plugin-development, users, plugins, password, usermodel
  
  > **Comments:**
  > **username_1**: Do you mean that you want the user to have an authenticated session to update any field?  Or you want them to not only have an authenticated session, but to re-enter their password so you can verify it before updating any field?  
  > **username_0**: @username_1 re-enter the password to verify. Is that possible?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2016-02-23. Score: 2 | Accepted answer
  
  You'd create a Craft [plugin](https://craftcms.com/docs/plugins) with a [controller](https://craftcms.com/docs/plugins/controllers) that has an [action](https://craftcms.com/docs/plugins/controllers#posting-to-controller-actions), say `actionSaveForm()`.
  
  Your controller would look for a `password` POST variable and if that existed, validate that against the currently logged in user's account to make sure it was a match. If so, continue onto Craft's `saveUser` or `saveEntry`, etc. (whatever you're using the form for, otherwise, return a validation error message.
  
  Roughly like this:
  
  ```
  public function actionSaveForm()
  {
      $this->requirePostRequest();
      craft()->userSession->requireLogin();
  
      $password = craft()->request->getRequiredPost('password');
      {# grab anything else you need from POST #}
  
      $currentUser = craft()->userSession->getUser();
  
      if (craft()->users->validatePassword($currentUser->password, $password))
      {
          {# saveEntry, saveUser, etc. then redirect #}
      }
  
      // Invalid Password
      craft()->urlManager->setRouteVariables(array(
          'error' => "Invalid Password"
      ));
  }
  
  ```
  
  
  ---
  
  