如何在laravel中获取加密的密码值？

Question

I am trying to change the password of a user for this i need to check that old password of that user does match with the value i am getting from html "oldpass" text box. If the existing password value and "oldpass" value matches the new password will be updated in database.The password value i am getting from the database is encrypted.

$userpass = User::where('id', '=', Session::get('userid'))->get(array('password')); The problem is that $userpass returns a null value .

Here is the code:

    $oldpass = Hash::make(Input::get('oldpass'));//Getting password from html form
    $userpass = User::where('id', '=', Session::get('userid'))->get(array('password'));//Getting password value from database Users table
    if ($oldpass === $userpass) {

         User::where('id', '=', Session::get('userid'))
            ->update(array(
                'password' => Hash::make(Input::get('newpass'))
    ));

    } else {
        Return View::make('changepass.changepass')
                        ->with('errormessage', 'Password does not match');
    }

Answer 1

There are two main problems here.

1. On one hand, $userpass is returning null because get() is not the appropiate function to fecth a column. You can use pluck for that (see the query builder docs )

   Anyway you can just call the attribute once you fetch the user like:

   $userpass = User::find(Session::get('userid'))->password;

2. You are trying to compare a hashed password with a plain password. Laravel uses Guard by default to manage user Authentication and Guard uses Hash::make to store it. You should compare hashes with:

   Hash::check($oldpass, $userpass)

You could also just check with Guard the user credentials are correct with Auth::validate($credentials) (see Laravel Security ) and then change the password like:

if(Auth::validate('id' => Session::get('userid'), 'password' => Input::get('oldpass'))){
  //Assuming user was authenticated before. If not use Auth::attempt instead of validate
  Auth::user()->password = Hash::make(Input::get('newpass')); 
} else {
    Return View::make('changepass.changepass')
                    ->with('errormessage', 'Password does not match');
}