Cakephp 3 : Current password match in controller - cakephp

Question

I am trying to match current password before if change. For that I have taken Auth password and then I matched it with current password. But it's returning always false.
Here is the controller code that I have tried
if ($this->request->is(['patch', 'post', 'put'])) {
$obj = new DefaultPasswordHasher;
$postpassword = $obj->hash($this->request->data['current_password']);
if($this->Auth->user('password') == $postpassword)
{
// code to save change password.
}
else
$this->Flash->error(__('The password you have entered does not match !'));
}
Here $postpassword hash working fine, but $this->Auth->user('password') return value 1. How can I get auth password and match with $postpassword ?
Edit
I have get some knowledge then I have solve this problem like this way
$password = '$2y$10$pHbHu6xhNAw/v5HuQ1DSjOm5MPkqZukD1.532ACu7YLgD1ef9K7i2';
if ($this->request->is(['patch', 'post', 'put'])) {
$obj = new DefaultPasswordHasher;
$postpassword = $obj->check($this->request->data['current_password'], $password);
if($postpassword==1)
$this -> set('password',"hello");
}
Now I need just $this->Auth->user('password'); in controller.
Is it possible in cakephp auth component ?

Answer 1

Its pretty easy this way:
Insert this in your (Users)Table :
use Cake\Auth\DefaultPasswordHasher;
use Cake\Validation\Validator;
Extend your function validationDefault(Validator $validator ) like the following:
public function validationDefault(Validator $validator ) {
$validator
->add('current_password','custom',[
'rule'=> function($value, $context){
$user = $this->get($context['data']['id']);
if ($user) {
if ((new DefaultPasswordHasher)->check($value, $user->password)) {
return true;
}
}
return false;
},
'message'=>'The old password does not match the current password!',
])
->notEmpty('current_password');
return $validator;
}
And thats it! :)

Answer 2

The authentication adapter removes the password before returning the data for the identified user, however you should receive null, not 1.
Anyways, if you need that information, you'll have to read it manually, like for example
$Table->get($this->Auth->user('id'))->password
However, as already mentioned in the comments, this is stuff that is better being done using validation or application rules.
See for example DefaultPasswordHasher generating different hash for the same value

Answer 3

No need to hash password,Auth will perform all.
if ($this->request->is(['patch', 'post', 'put'])) {
$obj = new DefaultPasswordHasher;
if($this->Auth->user('password') == $this->request->data['current_password'])
{
// code to save change password.
}
else
$this->Flash->error(__('The password you have entered does not match !'));
}