Kohana 3.3 check old password is correct before changing password - kohana-orm

Question

Using Auth ORM, how can I tell if the old password is correct before changing the password. I have seen code for older versions of Kohana which uses the find_salt method, but this no longer applicable in version 3.3.
Any ideas?

Answer 1

There is a better way to do this using Validation class:
if($post = $this->request->post()) {
$user = Auth::instance()->get_user();
$validation = Validation::factory($post)
->rule('old_password', array(Auth::instance(), 'check_password'));
// Rules for password (model rules applies after hash)
$extra_rules = Validation::factory($post)
->rule('password', 'not_empty')
->rule('password', 'min_length', array(':value', 8))
->rule('password', 'matches', array(':validation', 'password', 'password_confirm'));
try {
if(!$validation->check()) {
throw new ORM_Validation_Exception('password', $validation);
}
$user->password = $post['password'];
$user->update($extra_rules);
}catch(ORM_Validation_Exception $e){
// Handle errors
}
}

Answer 2

Use the hash() method to hash the password string, after compare with the stored one.
$auth = Auth::instance();
$user = ORM::factory('user')
->where('username', '=', 'User')
->find();
if ($auth->hash($_POST['password']) == $user->password)
{
// Passwords match, change here.
}
else
{
// Passwords not match.
}