{"record":{"id":"8700c45e7128109c","repo":"flarum/framework","slug":"validationexception-messages-from-password-validator","errorCode":null,"errorMessage":"ValidationException (messages from password validator)","messagePattern":"ValidationException \\(messages from password validator\\)","errorType":"validation","errorClass":"ValidationException","httpStatus":null,"severity":"warning","filePath":"framework/core/src/Forum/Controller/SavePasswordController.php","lineNumber":57,"sourceCode":"    }\n\n    public function handle(Request $request): ResponseInterface\n    {\n        $input = $request->getParsedBody();\n\n        $token = PasswordToken::validOrFail(Arr::get($input, 'passwordToken'));\n\n        $password = Arr::get($input, 'password');\n\n        try {\n            // todo: probably shouldn't use the user validator for this,\n            // passwords should be validated separately\n            $this->validator->assertValid(compact('password'));\n\n            $validator = $this->validatorFactory->make($input, ['password' => 'required|confirmed']);\n\n            if ($validator->fails()) {\n                throw new ValidationException($validator);\n            }\n        } catch (ValidationException $e) {\n            $request->getAttribute('session')->put('errors', new MessageBag($e->errors()));\n\n            // @todo: must return a 422 instead, look into renderable exceptions.\n            return new RedirectResponse($this->url->to('forum')->route('resetPassword', ['token' => $token->token]));\n        }\n\n        $token->user->changePassword($password);\n        $token->user->save();\n\n        $this->dispatchEventsFor($token->user);\n\n        $session = $request->getAttribute('session');\n        $accessToken = SessionAccessToken::generate($token->user->id);\n        $this->authenticator->logIn($session, $accessToken);\n\n        return new RedirectResponse($this->url->to('forum')->base());","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/flarum/framework/blob/4b939f685389bfe8a380e9e28ddf305a1c66950c/framework/core/src/Forum/Controller/SavePasswordController.php#L39-L75","documentation":"SavePasswordController throws ValidationException when the submitted password fails the application's password validator (via validator->assertValid) or the 'required|confirmed' Laravel rule (mismatched password/confirmation or empty password). The exception is caught in the same method; its messages are stored in the session error bag and the user is redirected back to the reset-password route with the token.","triggerScenarios":"Submitting the password-reset form with an empty password, a password that fails the configured password rules (length/complexity from the 'password' validator registration), or a confirmation field that does not match the password field.","commonSituations":"Users typing differing values in 'password' and 'confirmation' fields during password reset; passwords shorter than the minimum configured length; CSRF/SESSION flows where the form posts before all fields are filled.","solutions":["Ensure the password and password_confirmation fields contain identical non-empty values.","Check the flashed session errors (or the redirect page) for the exact validation messages and fix the password to meet the configured rules (typically min length via Flarum's password validator).","Reuse the same reset URL (including the token) shown in the redirect to re-submit the form."],"exampleFix":"// before\n// POST: password=secret1, password_confirmation=secret2\n\n// after: matching confirmation meeting min length\n// POST: password=Sup3rSecret!, password_confirmation=Sup3rSecret!","handlingStrategy":"validation","validationCode":"// client-side before submitting reset form\nif (!password || password !== confirmation) {\n  showError('Passwords must match and not be empty');\n  return;\n}\nif (password.length < 8) { showError('Password too short'); return; }","typeGuard":null,"tryCatchPattern":"// server side already catches it; on the redirect page render:\n$errors = $session->get('errors');\nforeach ($errors?->all() ?? [] as $msg) { echo $msg; }","preventionTips":["Make password and confirmation fields identical and non-empty.","Show password requirements (min length/complexity) on the form itself.","Reuse the redirect URL's token when re-submitting after a validation failure."],"tags":["flarum","validation","password","form"],"backgroundTag":"schema-validation-failed","analyzedSha":"4b939f685389bfe8a380e9e28ddf305a1c66950c","analyzedAt":"2026-09-15T18:09:20.879Z","contentChangedAt":"2026-09-15T18:09:20.879Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}