Change password without the old password

[mateosantosdev]

Hi,

Is there any way to update the user password without the old password?

[ocram]

Thanks!

Do you want to do this as a user (i.e. let the user do this on their own) or as an administrator?

For the first case, the decision to require the old password as well has been intentional. But perhaps there might be some use cases where this is not required.

[mateosantosdev]

Hi ocram,

Yes, I want to do this as a user.

I've seen the function updatePassword inside Auth.php :)

[ocram]

Will be available shortly, using a small wrapper around updatePassword. Thanks!

[fdiengdoh]

I wasn't sure if this would be secure? but isn't password update a sensitive access? What if someone use rememberme by mistake on a public computer and somebody change the password without needing to input the old password?

[fdiengdoh]

But as an admin it sound logical.

[ocram]

@fdiengdoh You're absolutely right. That's why the current method for changing the password still requires the old password to be entered. With the new method added, the old one will still be the recommended one and the default.

[ocram]

Implemented in:

• 1800525
• 62c5fab
• 7272fbb
• 91f50a8

This is available in a new major version, v6.0.0, which comes with a few breaking changes. For a guide on how to upgrade, please see the migration notes in Migration.md.