cakePHP pre-populates password field and breaks on update - cakephp

Question

I have a user profile update page, which pre-populates the text fields with the users information gathered from $this->request->data. Everything works fine, except the password field is pre-populated with what appears to be the encrypted password from the database, so on save, it fails the validation as the password exceeds the number of characters allowed, and even if it stores, it will then replace the users actual password with the encrypted same password, if that makes sense.
What would be the best work-around for this?
Controller:
public function profile() {
if($this->request->is('post') || $this->request->is('put')) {
if($this->Auth->user("id") == $this->request->data['User']['id']) {
$this->request->data['User']['user_status_id'] = $this->Auth->user("user_status_id");
$this->request->data['User']['user_type_id'] = $this->Auth->user("user_type_id");
if($this->User->save($this->request->data)) {
$this->Session->setFlash('Your profile has been updated','default',array('class'=>'success'));
} else {
$this->Session->setFlash("An error has occured updating your profile.");
}
} else {
$this->Session->setFlash("Unable to save this result as there is an ID mismatch.");
}
} else {
$this->request->data = $this->User->read(null,$this->Auth->user("id"));
}
}
View:
<h1>Profile</h1>
<h3>Update your profile</h3>
<div class="left">
<div class="formContainer">
<?php
echo $this->Form->create('User');
echo $this->Form->input('username',array("id" => "profileUsername"));
echo $this->Form->input('password',array("id" => "profilePassword"));
echo $this->Form->input('company');
echo $this->Form->input('first_name');
echo $this->Form->input('last_name');
echo $this->Form->input('telephone');
echo $this->Form->input('fax');
echo $this->Form->input('id',array('type' => 'hidden'));
echo $this->Form->end(__('Update'));
?>
</div>
</div>

Answer 1

The problem you have is, if you have stored your password as you should (with a one way hash), you can't reverse it to show the plain text version so you could simply set the password data to null (leaving the password field empty):
$this->request->data['User']['password'] = NULL;
You then have two options:
Require the users password to update their data (a nice little security measure)
Only update the users password when the user has entered a new password
The 2nd option may break your validation if you have set password validation rules to allowEmpty => false, in this case you could use multiple validation sets which you can do by following either of these (all work in cakephp 2.x) multivalidateable behaviour, multiple validation sets

Answer 2

read this and use this behavior:
http://www.dereuromark.de/2011/08/25/working-with-passwords-in-cakephp
the password is a one-way ticket - due to the technical details of hashs.
basically you never pass the password hash back into the view. always display empty fields (like you should have seen on pretty much every other website in the www).
you then ignore and posted field which is empty. only if the password field is freshly set you actually trigger the validation.

Answer 3

<?php echo $this->Form->input('password', array('label' => false,'type'=>'password','required'=>'false')); ?>
Output
<input name="data[User][password]" type="password" id="UserPassword">
Be careful! use this only on the edit part

Answer 4

$this->Form->input('password',array('value'=>null));