Cakephp password change not working - authentication

Question

I'm using cakephp 2.1, where I'm trying to change the password of an user through a link which the user will receive when a forgot password request is make.
The link looks something like this
../myApp/users/change_password/1
I'm passing the user id in the link. i.e, 1 as in above.
The view i.e, change_password.ctp is as below
<?php echo $this->Form->create('User', array('controller' => 'users', 'action' => 'change_password', 'class' => 'well')); ?>
<?php echo $this->Form->input('User.id',array('value' => $this->params['pass'][0],'type'=>'hidden')); ?>
<?php echo $this->Form->label('password', 'Password', array('class' => 'control-label')); ?>
<?php echo $this->Form->password('password', array('class' => 'span3', 'type' => 'password')); ?>
<?php echo $this->Form->error('password', null , array('wrap' => 'span', 'class' => 'help-inline')); ?>
<?php echo $this->Form->submit('Change Password', array('class' => 'btn')); ?>
<?php echo $this->Form->end(); ?>
And the controller is as follows
public function change_password() {
if($this->request->is('post')) {
if ($this->User->save($this->request->data)) {
$this->Session->setFlash('Password has been changed.', 'default/flash_success');
$this->redirect(array('controller' => 'movies', 'action' => 'index'));
} else {
$this->Session->setFlash('Password could not be changed.', 'default/flash_error');
$this->redirect(array('controller' => 'movies', 'action' => 'index'));
}
}
}
But I'm not able to save the password.

Answer 1

So if i just change the user id in the url, i can change the password of an other user?
/myApp/users/change_password/2
That is not secure at all. You should reconsider an other approach.
However, the answer for your question is:
You are probably not able to change the password because the data is not validated.
Do you have setup validation rules in the User.php model? If yes, you must unset the validation rules before saving the User.
Example: unset($this->User->validate['username']);
For more information about model validation, read the documentation