CakePHP validator rules in UsersTable.php wont work - cakephp

Question

I'm creating a change password form in CakePHP, which requires that a user enter his/her current password, new password, and confirm new password. After all that is entered, the user's password will be changed, given that all entries follow the validation rules that are set.
However, the validation rules aren't working. The user doesn't have to fill in all of the fields, set the new password to a certain length, make sure that the new password and confirm password fields match, etc. I cant seem to find out what the problem is.
I'll provide all of the relevant code below. Thanks :)
change_password.ctp (The view file)
<div class="users form large-9 medium-9 columns">
<?= $this->form->create() ?>
<fieldset>
<legend> <?= __('Change Password') ?> </legend>
<?= $this->Form->input('current_password', ['type' => 'password']) ?>
<?= $this->Form->input('new_password', ['type' => 'password']) ?>
<?= $this->Form->input('confirm_new_password', ['type' => 'password']) ?>
</fieldset>
<?= $this->Form->button(__('Save')) ?>
<?= $this->Form->end() ?>
</div>
changePassword() in UsersController
public function changePassword()
{
$user = $this->Users->get($this->Auth->user('id'));
if (!empty($this->request->data)) {
$user = $this->Users->patchEntity($user, [
'password' => $this->request->data['new_password'],
],
['validate' => 'password']
);
if ($this->Users->save($user)) {
$this->Flash->success('The password is successfully changed');
$this->redirect('/users');
} else {
$this->Flash->error('There was an error during the save!');
}
}
$this->set('user', $user);
}
validationPassword() in UsersTable (i.e The validation rules)
public function validationPassword(Validator $validator )
{
$validator
->add('current_password','custom',[
'rule'=> function($value, $context){
$user = $this->get($context['data']['id']);
if ($user) {
if ((new DefaultPasswordHasher)->check($value, $user->password)) {
return true;
}
}
return false;
},
'message'=>'Incorrect Password!',
])
->notEmpty('current_password');
$validator
->add('new_password', [
'length' => [
'rule' => ['minLength', 6],
'message' => 'The password must be at least 6 characters!',
]
])
->add('new_password',[
'match'=>[
'rule'=> ['compareWith','confirm_new_password'],
'message'=>'The passwords does not match!',
]
])
->notEmpty('new_password');
$validator
->add('confirm_new_password', [
'length' => [
'rule' => ['minLength', 6],
'message' => 'The password must be at least 6 characters!',
]
])
->add('confirm_new_password',[
'match'=>[
'rule'=> ['compareWith','new_password'],
'message'=>'The passwords does not match!',
]
])
->notEmpty('confirm_new_password');
return $validator;
}
EDIT: Added User.php file
<?php
namespace App\Model\Entity;
use Cake\ORM\Entity;
use Cake\Auth\DefaultPasswordHasher;
use Cake\Validation\Validator;
/**
* User Entity.
*
* #property int $id
* #property string $first_name
* #property string $last_name
* #property string $email
* #property string $username
* #property string $password
*/
class User extends Entity
{
/**
* Fields that can be mass assigned using newEntity() or patchEntity().
*
* Note that when '*' is set to true, this allows all unspecified fields to
* be mass assigned. For security purposes, it is advised to set '*' to false
* (or remove it), and explicitly make individual fields accessible as needed.
*
* #var array
*/
protected $_accessible = [
'*' => true,
'id' => false,
];
/**
* Fields that are excluded from JSON an array versions of the entity.
*
* #var array
*/
protected $_hidden = [
'password'
];
protected function _setPassword($value) {
$hasher = new DefaultPasswordHasher();
return $hasher->hash($value);
}
}

Answer 1

You have validation rules for fields current_password, new_password and confirm_new_password but you are only setting the field password with patchEntity that's why this validators are not called.
public function changePassword()
{
...
$user = $this->Users->patchEntity($user, [
'password' => $this->request->data['new_password'], // There is no validator defined for the field 'password'
],
['validate' => 'password']
);
...
}
In your case you must change your code with
public function changePassword()
{
...
$user = $this->Users->patchEntity($user, [
'password' => $this->request->data['new_password'], // Your actual field in db
'current_password' => $this->request->data['current_password'], // Trigger validation rule current_password
'new_password' => $this->request->data['new_password'], // Trigger validation rule new_password
'confirm_new_password' => $this->request->data['new_password'], // Trigger validation rule confirm_new_password
],
['validate' => 'password']
);
...
}
In the view file you have also forgot to pass the entity as first parameter of Form::create()