REST user updates need to validate password using UserAuthInterface

It has been over 9 years since there was work here.

Can someone confirm if this is still relevant?

I am setting the status to Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.

Thanks

This looks like it's still valid, at least in the sense that User::checkExistingPassword() has the same code that's changed in this issue and it's still called from ProtectedUserFieldConstraintValidator. I think we

There's now UserAuthenticationInterface which accepts an $account, which covers the last paragraph of the issue summary.

Having said that I'm not convinced that the patch is correct, it's calling the auth service from the user entity, but I think we might want to call the auth service from the validator instead, and then maybe deprecate the method on User.

Hello, I've created a merge request to move the checkExistingPassword method into the UserAuthenticationInterface and use it in the ProtectedUserFieldConstraintValidator. Let me know if I can do any other task.

Believe we are still suppose to use dependency injection.

Also issue summary should be complete

Thanks

Sure, dependency injection added to the Constraint Validator, let me know if i can help with other tasks.

Haven't fully reviewed but issue summary is incomplete

Summary updated