I'm trying to reset a user password programmatically in Drupal 8 without the email link. For this the first step would be to check if the password(which is plain) that the user enters in the password reset form is matching with the hashed password of the respective user. And then save the new password.
Each time I hash the password, its giving a different value, this is because its salted. How shall I compare the password which the user enters in the form with the hashed password from the table.
This is the code that I have in my controller for checking the current password :
<?php
/**
* @file
* contains \Drupal\customer_profile\Controller\ProfileUpdateController
*/
namespace Drupal\customer_profile\Controller;
use Drupal\Core\Controller\ControllerBase;
use Symfony\Component\HttpFoundation\JsonResponse;
use Drupal\Core\Password\PhpassHashedPassword;
use Drupal\Core\Password\PasswordInterface;
class ProfileUpdateController extends ControllerBase {
$user =\Drupal\user\Entity\User::load(\Drupal::currentUser()->id());
$ret = \Drupal\Core\Password\PasswordInterface::check('secret', $user);
//$user->setPassword('secret');
//$pass = $user->save();
$response->password = $ret;
return new JsonResponse($response);
}
}
After using \Drupal\Core\Password\PasswordInterface::check() method, for comparing the plain text password with the hash password, I get this fatal error :
Fatal error: Non-static method Drupal\Core\Password\PasswordInterface::check() cannot be called statically, assuming $this from incompatible context in C:\xampp\htdocs\ijarah\modules\custom\customer_profile\src\Controller\ProfileUpdateController.php on line 725
In Drupal 7 we have user_check_password to check the password with string and user_hash_password for hashing. How can I approach the same in Drupal 8.
Please help.