Hi there,
This is a follow-up question to one posted here:
https://toolset.com/forums/topic/questions-about-user-forms-cred-plugin/
I am creating a user form for logged in users to change their passwords. The form has three fields and a button:
enter current password: _______
enter new password: _______
enter new password again: _______
[submit button]
The Toolset CRED plugin natively handles input fields for the new password and verification. I am adding my own field for the current password. I've followed the instructions in the other forum posting about using the wp_check_password() function inside the "cred_form_validate" hook. What I'm unsure how to do is 1) return a failing status if the current password is incorrect, stopping the submission from proceeding, and 2) display an error message on the form when the page refreshes.
Can you offer any guidance? I can also include a snippet of code of what I attempted to do.
Saul
Hi Saul,
Thank you for contacting us and I'd be happy to assist.
On my test website, I was able to use the "cred_form_validate" hook and the "wp_check_password" function together, by following these steps:
1. In a user form to edit the current user, I created a "password" type generic field, with the slug "current-password".
2. Next, I used the following custom function attached to the "cred_form_validate" hook, which sets the errors if the current password field is empty or if the entered password is not correct:
add_filter('cred_form_validate', 'validate_form_current_password');
function validate_form_current_password( $data ) {
list($fields,$errors)=$data;
// get the ID of the user being edited
$user_id = $fields['_cred_cred_prefix_post_id']['value'];
// empty check for the current password field
if (empty($fields['current-password']['value'])) {
$errors['current-password'] = 'Current password field cannot be empty!';
} else {
// if the current password field is not empty, get the user's details
$user = get_user_by( 'ID', $user_id );
// check if the user password matches
if ( !($user && wp_check_password( $fields['current-password']['value'], $user->data->user_pass, $user_id )) ) {
// if not, set this error
$errors['current-password'] = 'Current password is not correct!';
}
}
return array($fields,$errors);
}
I hope this helps and you can compare this code with the one that you have and make the adjustments, accordingly.
regards,
Waqar
Waqar,
This is excellent! Thank you. So all I need to do is populate the $errors array accordingly, and the form submission will fail? Is that all it takes to halt the form?
Also, similar to another question in another thread, can I edit the error message for the field? I'm using a custom error message now, but it contains an ungainly "current-password:" prefix:
"current-password: The current password was not correct. The password has not been updated."
Can I remove that prefix? (I'd also like to change the "The user was not saved because of the following problem:" message above it. See the attached screenshot.)
Thank you.
Saul
Glad my message helped.
> So all I need to do is populate the $errors array accordingly, and the form submission will fail? Is that all it takes to halt the form?
- Yes, your understanding is correct.
> Also, similar to another question in another thread, can I edit the error message for the field? I'm using a custom error message now, but it contains an ungainly "current-password:" prefix. Can I remove that prefix?
- I'm afraid, through the 'cred_form_validate', it is only possible to set the error message, but the prefix field slug, can't be removed. You'll need to use some custom CSS or JS code to manipulate/hide it.
Sounds good. Thanks again, Waqar!
Saul
