title: Checking users current password when changing account settings
body: <p>I am building a form for a logged in user to change their account settings (email and password). To do this, they need to be able to confirm their current password. This is how I'm building my form in <code>settings.ctp</code>:</p>
  
  <pre><code>&lt;div id="content-complex-image"&gt;
      &lt;div id="sidebar"&gt;
          &lt;ul&gt;
              &lt;li&gt;&lt;a href="/account/images"&gt;Your images&lt;/a&gt;&lt;/li&gt;
              &lt;li&gt;&lt;a href="/account/settings"&gt;Account settings&lt;/a&gt;&lt;/li&gt;
          &lt;/ul&gt;
      &lt;/div&gt;
      &lt;div id="content-inner"&gt;
          &lt;p&gt;Modify your account settings&lt;/p&gt;
          &lt;?php echo $this-&gt;Session-&gt;flash(); ?&gt;
          &lt;?php
              echo $this-&gt;Form-&gt;create('User');
              echo $this-&gt;Form-&gt;input('currentPassword', array('type' =&gt; 'password'));
              echo $this-&gt;Form-&gt;input('username', array('disabled' =&gt; 'disabled', 'value' =&gt; $username));
              echo $this-&gt;Form-&gt;input('email');
              echo $this-&gt;Form-&gt;input('password', array('type' =&gt; 'password'));
              echo $this-&gt;Form-&gt;end('Update');
          ?&gt;
      &lt;/div&gt;
      &lt;div class="clear"&gt;&lt;/div&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>and this is my controller action:</p>
  
  <pre><code>public function settings() {
      $this-&gt;set('title_for_layout', 'Account Settings');
  
      $this-&gt;User-&gt;id = $this-&gt;Auth-&gt;user('id');
      if ($this-&gt;request-&gt;is('post')) {
          if($this-&gt;Auth-&gt;user('password') == $this-&gt;request-&gt;data['User']['currentPassword']) {
              if ($this-&gt;User-&gt;save($this-&gt;request-&gt;data)) {
                  $this-&gt;Session-&gt;setFlash('Your details have been saved');
                  $this-&gt;redirect(array('action' =&gt; 'settings'));
              } else {
                  $this-&gt;Session-&gt;setFlash('Your details could not be updated. Try again.');
              }
          } else {
               $this-&gt;Session-&gt;setFlash('Invalid password. Try again.');
          }            
      }
  }
  </code></pre>
  
  <p>However, the <code>if()</code> for a password check always evaluates to false and always shows the "invalid password" message. I'm guessing I'm not checking the password correctly, but I don't know the correct way to do it.</p>
  
  <p>Also, I don't want the user to be able to change their username. I know I've set the form field to disabled, but if a user sends a post request to my settings action they could change their username. How do I stop the username from being updated with <code>$this-&gt;User-&gt;save()</code>?</p>
  
  <p>EDIT: Looks like two problems, one, I wasn't hashing the password before the comparison and two, <code>$this-&gt;Auth-&gt;user('password')</code> is actually NULL. Which raises another question, how do I get the users hashed password from the database in order to compare it?</p>