0

Try to add function to let user reset password. But encounter issue. Before update user table with the new password, I need to check if user enters the right current password. At this step, it always gives me apology message saying 'the current password entered is not right' Here is my code:

# ensure current password is right 
    current_password = db.execute("SELECT hash FROM users WHERE id = :user_id", user_id = session["user_id"])
    if pwd_context.encrypt(request.form["oldpassword"]) != current_password[0]["hash"]:
        return apology("Current password not right")

Is it because I compare the two hash values? Should I dehash the hash value to password to compare?

Thanks

2 Answers 2

0

You cannot directly compare hashes (as you see, that doesn't work) and there is no decrypt. What to do, what to do? Review login and "...notice how it uses pwd_context.verify to compare hashes of users' passwords."

1
  • Thanks! Everything mentioned in the pset document is useful!! Jun 20, 2017 at 10:33
0

I'm not 100% on this since I'm on the same pset as you and a lot further behind, BUT

Your SELECT function assigns a single value to current_password, whereas when you try and compare it with the hash of the oldpassword, you are treating current_password as if it is an array of values.

If you change your select function to "SELECT * FROM users WHERE id=:user_id" it might work since you're not just selecting an individual hash, but a set of data which you can access with [0]["hash"]

Alternatively, try replacing current_password[0]["hash"] with just 'hash'.

But I could be wrong.

3
  • execute with a SELECT always returns a list of rows, as per Hints in the spec "If str is a SELECT, then execute returns a list of zero or more dict objects, inside of which are keys and values representing a table’s fields and cells, respectively." Jun 19, 2017 at 2:39
  • Oh i see.. so you can't retrieve an individual value from a table without specifying which column it is in? I looked at your answer and I was wondering - you said you cant directly compare hashes - but isn't that what you do when you're logging in? Jun 19, 2017 at 10:46
  • When using select, you get a list of dictionaries. Even only select hash, what you will get is [{'hash': 'XXXX'}, {'hash':'YYYY'}, ...] so need to specify if you need value in the dictionary. Jun 20, 2017 at 10:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .