pset7 additional feature - reset password function

Question

Try to add function to let user reset password. But encounter issue. Before update user table with the new password, I need to check if user enters the right current password. At this step, it always gives me apology message saying 'the current password entered is not right' Here is my code:

# ensure current password is right 
    current_password = db.execute("SELECT hash FROM users WHERE id = :user_id", user_id = session["user_id"])
    if pwd_context.encrypt(request.form["oldpassword"]) != current_password[0]["hash"]:
        return apology("Current password not right")

Is it because I compare the two hash values? Should I dehash the hash value to password to compare?

Thanks

Answer 1

You cannot directly compare hashes (as you see, that doesn't work) and there is no decrypt. What to do, what to do? Review login and "...notice how it uses pwd_context.verify to compare hashes of users' passwords."

Answer 2

I'm not 100% on this since I'm on the same pset as you and a lot further behind, BUT

Your SELECT function assigns a single value to current_password, whereas when you try and compare it with the hash of the oldpassword, you are treating current_password as if it is an array of values.

If you change your select function to "SELECT * FROM users WHERE id=:user_id" it might work since you're not just selecting an individual hash, but a set of data which you can access with [0]["hash"]

Alternatively, try replacing current_password[0]["hash"] with just 'hash'.

But I could be wrong.