flarum/framework · warning · ValidationException

ValidationException (messages from password validator)

Error message

ValidationException (messages from password validator)

What it means

SavePasswordController throws ValidationException when the submitted password fails the application's password validator (via validator->assertValid) or the 'required|confirmed' Laravel rule (mismatched password/confirmation or empty password). The exception is caught in the same method; its messages are stored in the session error bag and the user is redirected back to the reset-password route with the token.

Solutions

1. Ensure the password and password_confirmation fields contain identical non-empty values.
2. Check the flashed session errors (or the redirect page) for the exact validation messages and fix the password to meet the configured rules (typically min length via Flarum's password validator).
3. Reuse the same reset URL (including the token) shown in the redirect to re-submit the form.

Example fix

// before
// POST: password=secret1, password_confirmation=secret2

// after: matching confirmation meeting min length
// POST: password=Sup3rSecret!, password_confirmation=Sup3rSecret!

// client-side before submitting reset form
if (!password || password !== confirmation) {
  showError('Passwords must match and not be empty');
  return;
}
if (password.length < 8) { showError('Password too short'); return; }

// server side already catches it; on the redirect page render:
$errors = $session->get('errors');
foreach ($errors?->all() ?? [] as $msg) { echo $msg; }

When it happens

Trigger: Submitting the password-reset form with an empty password, a password that fails the configured password rules (length/complexity from the 'password' validator registration), or a confirmation field that does not match the password field.

Common situations: Users typing differing values in 'password' and 'confirmation' fields during password reset; passwords shorter than the minimum configured length; CSRF/SESSION flows where the form posts before all fields are filled.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• The admin password did not match its confirmation.
• Incorrect password
• core.admin.appearance.custom_styles_cannot_use_less_features
• custom_less
• validation. (translated message for )

AI-assisted analysis of flarum/framework@4b939f6853 (2026-09-15). Data as JSON: /api/errors/8700c45e7128109c. Report an issue: GitHub.

Appendix: source

Thrown at framework/core/src/Forum/Controller/SavePasswordController.php:57

    }

    public function handle(Request $request): ResponseInterface
    {
        $input = $request->getParsedBody();

        $token = PasswordToken::validOrFail(Arr::get($input, 'passwordToken'));

        $password = Arr::get($input, 'password');

        try {
            // todo: probably shouldn't use the user validator for this,
            // passwords should be validated separately
            $this->validator->assertValid(compact('password'));

            $validator = $this->validatorFactory->make($input, ['password' => 'required|confirmed']);

            if ($validator->fails()) {
                throw new ValidationException($validator);
            }
        } catch (ValidationException $e) {
            $request->getAttribute('session')->put('errors', new MessageBag($e->errors()));

            // @todo: must return a 422 instead, look into renderable exceptions.
            return new RedirectResponse($this->url->to('forum')->route('resetPassword', ['token' => $token->token]));
        }

        $token->user->changePassword($password);
        $token->user->save();

        $this->dispatchEventsFor($token->user);

        $session = $request->getAttribute('session');
        $accessToken = SessionAccessToken::generate($token->user->id);
        $this->authenticator->logIn($session, $accessToken);

        return new RedirectResponse($this->url->to('forum')->base());

View on GitHub (pinned to 4b939f6853)