[feature request] Require current password when changing password

[telkins]

(I tried to request a feature but got a 404, so I apologize for submitting this in this manner.)

Wouldn't it be more secure to require a user to submit their current password when changing their password?

That's my feature request: that the user must supply their current password when changing their password.

Hope that makes sense. 🤓

[emmadesilva]

I was thinking that this should be added as well. Both because it prevents a password from being changed (say if you stay logged in while you leave your desk), but it also prevents against accidental changing.

[jeffgreco13]

Hey @telkins @caendesilva there was actually a bit of conversation about this in the breezy channel. At the time we deemed it not necessary, but I think this would make sense as a config option. I am going to review this in my next release!

[telkins]

Hey @telkins @caendesilva there was actually a bit of conversation about this in the breezy channel. At the time we deemed it not necessary, but I think this would make sense as a config option. I am going to review this in my next release!

Thx, @jeffgreco13 . Let me know if there's anything I can do to help. 🤓

[21p-sk]

My solution for this problem:

Custom ProfilePage

[...]
use JeffGreco13\FilamentBreezy\Pages\MyProfile as BaseProfile;

class UserProfile extends BaseProfile
[...]

[...]
protected function getUpdatePasswordFormSchema(): array
{
    return [
        Forms\Components\TextInput::make('current_password')
            ->label(__('Current Password'))
            ->password()
            ->currentPassword()
            ->required(),
        Forms\Components\TextInput::make('new_password')
            ->label(__('filament-breezy::default.fields.new_password'))
            ->password()
            ->rules([Password::defaults()])
            ->different('current_password')
            ->required(),
        Forms\Components\TextInput::make('new_password_confirmation')
            ->label(__('filament-breezy::default.fields.new_password_confirmation'))
            ->password()
            ->same('new_password')
            ->required(),
    ];
}

public function updatePassword()
{
    parent::updatePassword();

    $this->reset(['current_password']);
}
[...]

[emmadesilva]

My solution for this problem:

I think this looks really nice, and since it's so simple and lightweight it shouldn't add much footprint to the package by offering it as a config option in the base class.

[StanMenten-bp]

Any follow up on this one?

[jeffgreco13]

Available in Breezy v2