I want to create a login mechanism for users in my current project.
This is what I have done so far.
Created a function named executeLogin in the UsersActions class
class usersActions extends sfActions { public function executeLogin(sfWebRequest $request) { $this->form = new UsersLoginForm(); if($request->isMethod('post')) {
> public function configure()
> {
> $this->setWidgets(array(
> 'email' => new sfWidgetFormInput(),
> 'password' => new sfWidgetFormInputPassword()
> ));
// authentication public function doLogin(sfValidatorBase $validator, array $values) { if($values['email']!='') { // get the user $u = Doctrine_Core::getTable('User') ->createQuery('u') ->where('u.email = ?', $values['email']) ->limit(1);
$dbUser = $u->execute()->getFirst();
if(!$dbUser) {
// invalid username - generic message $error = new sfValidatorError($validator, 'Error with login'); // dont give too much info away // throw an error bound to the password field' throw new sfValidatorErrorSchema($validator, array('email' => $error));
} else {
$submittedPassword = $values['password']; $userObj = new User(); $hashedPassword = $userObj->hashPassword($submittedPassword);
$found = false;
if($hashedPassword == $dbUser->getPassword()) {
$found = true; }
if(!$found) { // invalid username - generic message $error = new sfValidatorError($validator, 'Error with login'); // dont give too much info away // throw an error bound to the password field' throw new sfValidatorErrorSchema($validator, array('password' => $error)); } } } }
then in my action i do the following:
public function executeLoginRegister(sfWebRequest $request) {
$this->form = new LoginForm();
// posted the form? if ($request->isMethod('post') && $request->getParameter('user')) { // set the form values and validate the form $this->form->bind($request->getParameter('user'));
if ($this->form->isValid()) { // user is authenticated } else { // user failed authentication } }
> > When I submit the form nothing happens at all. Please help me correct > this.
> > Thanks. > > WebRep > > Overall rating
> -- > If you want to report a vulnerability issue on symfony, please send it to > security at symfony-project.com
> You received this message because you are subscribed to the Google > Groups "symfony1" group. > To post to this group, send email to symfony1@googlegroups.com > To unsubscribe from this group, send email to > symfony1+unsubscribe@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/symfony1?hl=en
public function executeLogin(sfWebRequest $request)
{
$this->form = new UsersLoginForm();
if($request->isMethod('post'))
{
$this->form->bind($request->getParameter($this->form-
> // authentication
> public function doLogin(sfValidatorBase $validator, array $values)
> {
> if($values['email']!='') {
> // get the user
> $u = Doctrine_Core::getTable('User')
> ->createQuery('u')
> ->where('u.email = ?', $values['email'])
> ->limit(1);
> $dbUser = $u->execute()->getFirst();
> if(!$dbUser) {
> // invalid username - generic message
> $error = new sfValidatorError($validator, 'Error with
> login'); // dont give too much info away
> // throw an error bound to the password field'
> throw new sfValidatorErrorSchema($validator, array('email'
> => $error));
> if(!$found) {
> // invalid username - generic message
> $error = new sfValidatorError($validator, 'Error with
> login'); // dont give too much info away
> // throw an error bound to the password field'
> throw new sfValidatorErrorSchema($validator,
> array('password' => $error));
> }
> }
> }
> }
> then in my action i do the following:
> public function executeLoginRegister(sfWebRequest $request)
> {
> $this->form = new LoginForm();
> // posted the form?
> if ($request->isMethod('post') && $request->getParameter('user'))
> {
> // set the form values and validate the form
> $this->form->bind($request->getParameter('user'));
> if ($this->form->isValid())
> {
> // user is authenticated
> } else {
> // user failed authentication
> }
> }
> hope that helps!
> On Thu, Jun 23, 2011 at 12:25 PM, Manse <mans...@gmail.com> wrote:
> > Why not just use the sfDoctrineGuardUser plugin ... works a treat ...
> > > When I submit the form nothing happens at all. Please help me correct
> > this.
> > > Thanks.
> > > WebRep
> > > Overall rating
> > --
> > If you want to report a vulnerability issue on symfony, please send it to
> > security at symfony-project.com
> > You received this message because you are subscribed to the Google
> > Groups "symfony1" group.
> > To post to this group, send email to symfony1@googlegroups.com
> > To unsubscribe from this group, send email to
> > symfony1+unsubscribe@googlegroups.com
> > For more options, visit this group at
> >http://groups.google.com/group/symfony1?hl=en
> On Jun 23, 4:55 pm, Justen Doherty <phpc...@gmail.com> wrote: >> i've used the Login form to do the authentication/authorisation logic, if >> the form doesnt pass validation - the user isnt logged in..
>> // authentication >> public function doLogin(sfValidatorBase $validator, array $values) >> { >> if($values['email']!='') { >> // get the user >> $u = Doctrine_Core::getTable('User') >> ->createQuery('u') >> ->where('u.email = ?', $values['email']) >> ->limit(1);
>> $dbUser = $u->execute()->getFirst();
>> if(!$dbUser) {
>> // invalid username - generic message >> $error = new sfValidatorError($validator, 'Error with >> login'); // dont give too much info away >> // throw an error bound to the password field' >> throw new sfValidatorErrorSchema($validator, array('email' >> => $error));
>> if(!$found) { >> // invalid username - generic message >> $error = new sfValidatorError($validator, 'Error with >> login'); // dont give too much info away >> // throw an error bound to the password field' >> throw new sfValidatorErrorSchema($validator, >> array('password' => $error)); >> } >> } >> } >> }
>> then in my action i do the following:
>> public function executeLoginRegister(sfWebRequest $request) >> {
>> $this->form = new LoginForm();
>> // posted the form? >> if ($request->isMethod('post') && $request->getParameter('user')) >> { >> // set the form values and validate the form >> $this->form->bind($request->getParameter('user'));
>> if ($this->form->isValid()) >> { >> // user is authenticated >> } else { >> // user failed authentication >> } >> }
>> hope that helps!
>> On Thu, Jun 23, 2011 at 12:25 PM, Manse <mans...@gmail.com> wrote: >> > Why not just use the sfDoctrineGuardUser plugin ... works a treat ...
>> > -- >> > If you want to report a vulnerability issue on symfony, please send it to >> > security at symfony-project.com
>> > You received this message because you are subscribed to the Google >> > Groups "symfony1" group. >> > To post to this group, send email to symfony1@googlegroups.com >> > To unsubscribe from this group, send email to >> > symfony1+unsubscribe@googlegroups.com >> > For more options, visit this group at >> >http://groups.google.com/group/symfony1?hl=en
> -- > If you want to report a vulnerability issue on symfony, please send it to security at symfony-project.com
> You received this message because you are subscribed to the Google > Groups "symfony1" group. > To post to this group, send email to symfony1@googlegroups.com > To unsubscribe from this group, send email to > symfony1+unsubscribe@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/symfony1?hl=en
> > On Jun 23, 4:55 pm, Justen Doherty <phpc...@gmail.com> wrote:
> >> i've used the Login form to do the authentication/authorisation logic, if
> >> the form doesnt pass validation - the user isnt logged in..
> >> // authentication
> >> public function doLogin(sfValidatorBase $validator, array $values)
> >> {
> >> if($values['email']!='') {
> >> // get the user
> >> $u = Doctrine_Core::getTable('User')
> >> ->createQuery('u')
> >> ->where('u.email = ?', $values['email'])
> >> ->limit(1);
> >> $dbUser = $u->execute()->getFirst();
> >> if(!$dbUser) {
> >> // invalid username - generic message
> >> $error = new sfValidatorError($validator, 'Error with
> >> login'); // dont give too much info away
> >> // throw an error bound to the password field'
> >> throw new sfValidatorErrorSchema($validator, array('email'
> >> => $error));
> >> if(!$found) {
> >> // invalid username - generic message
> >> $error = new sfValidatorError($validator, 'Error with
> >> login'); // dont give too much info away
> >> // throw an error bound to the password field'
> >> throw new sfValidatorErrorSchema($validator,
> >> array('password' => $error));
> >> }
> >> }
> >> }
> >> }
> >> then in my action i do the following:
> >> public function executeLoginRegister(sfWebRequest $request)
> >> {
> >> $this->form = new LoginForm();
> >> // posted the form?
> >> if ($request->isMethod('post') && $request->getParameter('user'))
> >> {
> >> // set the form values and validate the form
> >> $this->form->bind($request->getParameter('user'));
> >> if ($this->form->isValid())
> >> {
> >> // user is authenticated
> >> } else {
> >> // user failed authentication
> >> }
> >> }
> >> hope that helps!
> >> On Thu, Jun 23, 2011 at 12:25 PM, Manse <mans...@gmail.com> wrote:
> >> > Why not just use the sfDoctrineGuardUser plugin ... works a treat ...
> >> > --
> >> > If you want to report a vulnerability issue on symfony, please send it to
> >> > security at symfony-project.com
> >> > You received this message because you are subscribed to the Google
> >> > Groups "symfony1" group.
> >> > To post to this group, send email to symfony1@googlegroups.com
> >> > To unsubscribe from this group, send email to
> >> > symfony1+unsubscribe@googlegroups.com
> >> > For more options, visit this group at
> >> >http://groups.google.com/group/symfony1?hl=en
You already got two very good tips: one was a hint to use sfDoctrineGuard, the other was a form class.
Justen Doherty sent the class, I recommend checking it, it's pretty much what I'm using it a lot of projects - delegating login validation to the form class, so the in action it's a simple `$form->isValid()`.
Manse sent the hint for the sfDoctrineGuardPlugin[1], I cannot recommend it enough, it's the de-facto standard for user authentication/authorization in the symfony 1 world. It's awesomely written, so even if you do not end up using it, reading the code is highly recommended.
On Fri, Jun 24, 2011 at 07:55, Gaurav Sharma <gaurav.v.sha...@gmail.com> wrote: > Yes I do, but it is only for now (as I have just started learning > symfony, I will learn that too, the symfony way).
> Can you help me with this? > i.e.
> What method or standard shall I use to handle password storage in > symfony?
> Is it same like encrypting it with sha1() and then checking the whole > string.... sort of logic..?
> Thanks
> On Jun 23, 6:12 pm, Gábor Fási <maerl...@gmail.com> wrote: >> Your code says that you store passwords in plaintext. That's a very bad idea.
>> On Thu, Jun 23, 2011 at 15:02, Gaurav Sharma <gaurav.v.sha...@gmail.com> wrote: >> > :) >> > thanks for your help. I appreciate it.
>> > On Jun 23, 4:55 pm, Justen Doherty <phpc...@gmail.com> wrote: >> >> i've used the Login form to do the authentication/authorisation logic, if >> >> the form doesnt pass validation - the user isnt logged in..
>> >> public function configure() >> >> { >> >> ....
>> >> // authentication >> >> public function doLogin(sfValidatorBase $validator, array $values) >> >> { >> >> if($values['email']!='') { >> >> // get the user >> >> $u = Doctrine_Core::getTable('User') >> >> ->createQuery('u') >> >> ->where('u.email = ?', $values['email']) >> >> ->limit(1);
>> >> $dbUser = $u->execute()->getFirst();
>> >> if(!$dbUser) {
>> >> // invalid username - generic message >> >> $error = new sfValidatorError($validator, 'Error with >> >> login'); // dont give too much info away >> >> // throw an error bound to the password field' >> >> throw new sfValidatorErrorSchema($validator, array('email' >> >> => $error));
>> >> if(!$found) { >> >> // invalid username - generic message >> >> $error = new sfValidatorError($validator, 'Error with >> >> login'); // dont give too much info away >> >> // throw an error bound to the password field' >> >> throw new sfValidatorErrorSchema($validator, >> >> array('password' => $error)); >> >> } >> >> } >> >> } >> >> }
>> >> then in my action i do the following:
>> >> public function executeLoginRegister(sfWebRequest $request) >> >> {
>> >> $this->form = new LoginForm();
>> >> // posted the form? >> >> if ($request->isMethod('post') && $request->getParameter('user')) >> >> { >> >> // set the form values and validate the form >> >> $this->form->bind($request->getParameter('user'));
>> >> if ($this->form->isValid()) >> >> { >> >> // user is authenticated >> >> } else { >> >> // user failed authentication >> >> } >> >> }
>> >> hope that helps!
>> >> On Thu, Jun 23, 2011 at 12:25 PM, Manse <mans...@gmail.com> wrote: >> >> > Why not just use the sfDoctrineGuardUser plugin ... works a treat ...