{"record":{"id":"1b0d247014fe1e91","repo":"flarum/framework","slug":"incorrect-password","errorCode":null,"errorMessage":"Incorrect password","messagePattern":"Incorrect password","errorType":"validation","errorClass":"ValidationException","httpStatus":422,"severity":"error","filePath":"extensions/gdpr/src/Api/Resource/ErasureRequestResource.php","lineNumber":98,"sourceCode":"                'user_id' => $context->getActor()->id,\n            ]);\n        }\n\n        return parent::newModel($context);\n    }\n\n    public function endpoints(): array\n    {\n        return [\n            Endpoint\\Create::make()\n                ->authenticated()\n                ->before(function (Context $context) {\n                    $actor = $context->getActor();\n\n                    // If they signed up using a third party oauth provider, they won't have a password\n                    // so we can't check it. We'll just assume they're authenticated.\n                    if ($actor->loginProviders()->count() === 0 && ! $actor->checkPassword(Arr::get($context->body(), 'meta.password', ''))) {\n                        throw new ValidationException(['password' => 'Incorrect password']);\n                    }\n                }),\n            Endpoint\\Update::make()\n                ->can('process'),\n            Endpoint\\Endpoint::make('cancel')\n                ->route('POST', '{id}/cancel')\n                ->authenticated()\n                ->can('cancel')\n                ->action(function (Context $context) {\n                    /** @var ErasureRequest $request */\n                    $request = $context->model;\n\n                    $request->cancelled_at = Carbon::now();\n                    $request->status = ErasureRequest::STATUS_CANCELLED;\n                    $request->user_confirmed_at = null;\n                    $request->verification_token = null;\n                    $request->save();\n","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/flarum/framework/blob/4b939f685389bfe8a380e9e28ddf305a1c66950c/extensions/gdpr/src/Api/Resource/ErasureRequestResource.php#L80-L116","documentation":"When a user confirms their own GDPR erasure request, the endpoint requires the account password; if checkPassword fails (or meta.password is absent) a ValidationException with field 'password' and message 'Incorrect password' is thrown in the ErasureRequestResource endpoint's before hook. Users created via third-party OAuth (no password) bypass the check.","triggerScenarios":"POST/PATCH on the erasure request resource (self-confirmation flow) where body meta.password is missing, empty, or does not match the actor's stored password hash.","commonSituations":"Frontend form not sending meta.password; user typo; user's password changed elsewhere; users migrated from other providers without password hashes.","solutions":["Enter the correct password of the account in the meta.password field of the request body.","If the password is forgotten, reset it first, then retry the erasure confirmation.","For OAuth-only accounts no password is required — the check is skipped automatically; confirm the account actually has no login providers if you expected a bypass.","Inspect the request payload to confirm meta.password is present and non-empty."],"exampleFix":"// before\n{ \"meta\": {} }\n// after\n{ \"meta\": { \"password\": \"current-account-password\" } }","handlingStrategy":"validation","validationCode":"if ($actor->loginProviders()->count() === 0 && empty($body['meta']['password'])) { /* require password input in the UI first */ }","typeGuard":null,"tryCatchPattern":"try { await api.confirmErasure(id, { meta: { password } }); } catch (e) { if (e.status === 422) showPasswordError(); }","preventionTips":["Always send meta.password in the confirmation payload","Handle OAuth-only accounts by hiding the password field","Verify password rules (changed passwords) before retrying"],"tags":["authentication","password","validation"],"backgroundTag":"authentication-required","analyzedSha":"4b939f685389bfe8a380e9e28ddf305a1c66950c","analyzedAt":"2026-09-15T18:09:20.879Z","contentChangedAt":"2026-09-15T18:09:20.879Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}