NO QUERY using CakePHP Authentication component - php

I'm using CakePHP 2.2.4, and I have started to work with Atuh Componenet.
This is my AppController:
class AppController extends Controller {
public $components = array('Auth', 'Session');
public function beforeFilter() {
$this->Auth->authorize = array('Controller');
$this->Auth->authenticate = array(
'Form' => array (
'scope' => array('User.active' => 1),
'fields' => array('username' => 'email', 'password' => 'password'),
)
);
}
public function isAuthorized($user) {
debug($user);
return true;
}
}
This is my User.php model
class User extends AppModel {
public $name = 'User';
/* Relazioni */
public $hasOne = 'Profile';
public $belongsTo = 'Role';
public $hasMany = array(
'Lead' => array(
'className' => 'Lead'
)
);
}
and this is my UserController.php
<?php
App::uses('AppController', 'Controller');
class UsersController extends AppController
{
public $name = 'Users';
public $uses = array();
public function beforeFilter()
{
parent::beforeFilter();
}
public function login()
{
if ($this->request->is('post'))
{
if ($this->Auth->login())
{
debug('Logged');
}
else
{
$this->Session->setFlash('Login non autorizzato', 'default', array('class' => 'errore'), 'login');
}
}
}
public function logout()
{
$this->redirect($this->Auth->logout());
}
}
I have a strange problem using Auth Component, because at the end of the layout I have sql_dump element, that prints NO QUERY.
However, If i put correct values I do not login
Why does Auth component is not working ?
EDIT:
The data of the request is:
Array
(
[User] => Array
(
[email] => test#test.it
[pwd] => abc
)
)

Your code in AppController is wrong
public function beforeFilter() {
$this->Auth->authorize = array('Controller');
$this->Auth->authenticate = array(
'Form' => array (
'scope' => array('User.active' => 1),
// password != pwd as you post it
'fields' => array('username' => 'email', 'password' => 'password'),
)
);
}
Change it to
'fields' => array('username' => 'email', 'password' => 'pwd'),
or make sure to post password instead of pwd in your form
Please see https://github.com/cakephp/cakephp/blob/master/lib/Cake/Controller/Component/Auth/FormAuthenticate.php for documentation on the matter

I'd like to post-fix this answer for anyone arriving here, who is unable to get logged in using Auth for which this example does not DIRECTLY Apply.
An important thing to remember is that Auth is expecting the underlying database columns to be "username" and "password". If for whatever reason you defer from this, for example if you want to validate on a users email (very common) and you change the table's column name to reflect this, than you must tell Auth about this.
The reason is because the underlying query will fail. Ultimately all that's happening behind the scene is a simply query matching the specified fields. For example (not exact - simply for demonstration purposes -- select *'s are bad):
SELECT * FROM users WHERE username = 'blahblahblah' AND password = 'someInsan31yh4sh3dpassw0rd'
If your underlying table is missing a "username" column in loo of an "email" column, than this query will obviously fail. Resulting in the inability to login and usually with no indication that the query failed (it is even omitted from the SQL dump). The following code in your AppController however will solve you issues:
public $components = array(
'Auth' => array(
'authenticate' => array(
'Form' => array(
'fields' => array('username' => 'columnUsedForValidatingUsername', 'password' => 'columnUserForValidatingPassword')
)
)
)
);
Jippi's answer was completely correct in this case. But I feel as though as an answerER on StackOverflow you owe it to anyone finding this to explain WHY the problem is occurring and provide an unspecific answer.
Cheers

Related

Custom validation in codeigniter 3

One thing I don't like about codeigniter is the validation logic being inside the controller, easily increasing and messing the code. In order to separate this logic the controller, I've created a model that imports the form_validation library:
Class BS_Validator extends CI_Model
{
protected $rules = array();
protected $fields = array();
# Get keys of fields.
public function getStructure()
{
return array_keys( $this->fields );
}
# Validate $_POST against the rules and fields.
public function validate()
{
$this->load->library('form_validation');
foreach( $this->rules as $key => $rule )
{
$this->form_validation->set_rules( $key, $this->fields[$key], $rule );
}
return $this->form_validation->run( $this );
}
}
For each validation I extend this class:
class User_Create extends BS_Validator
{
protected $fields = array(
'name' => 'Nome',
'email' => 'Email',
'password' => 'Senha',
'password_repeat' => 'Repetir senha'
);
protected $rules = array(
'name' => 'required|min_length[3]|max_length[50]',
'email' => 'required|min_length[8]|max_length[100]|valid_email|is_unique[users.email]',
'password' => 'required',
'password_repeat' => 'required|callback_password_repeat_check'
);
public function password_repeat_check ($password_repeat)
{
return true;
}
}
Everything works like a charm, except for the custom validation method, that is never called. In this specific case, it always returns (pasword_repeat_check) error.
What should I do to this method be recognized?
Couldn't manage to make it work this way.
The alterative I've used was to create a file MY_form_validation.php on libraries folder in order to extend the Form_validation class.
class BS_Form_validation extends CI_Form_validation
{
protected $CI;
function __construct($rules = array())
{
parent::__construct($rules);
}
public function password_repeat ($password_repeat)
{
return $_POST['password'] == $password_repeat;
}
}
With that I can create rules instead of callback rules, and it can be called as the following (without the need of the callback_ prefix):
protected $rules = array(
'name' => 'required|min_length[3]|max_length[50]',
'email' => 'required|min_length[8]|max_length[100]|valid_email|is_unique[users.email]',
'password' => 'required',
'password_repeat' => 'required|password_repeat'
);

call_user_func_array() expects parameter 1 to be a valid callback, no array or string given Kohana 3.3.4

Hey guys i have read and studied the kohana orm and auth modules. so i want to implement am admin section to my website. i get the error above and i have googled but can't seem to find the answer. am using Kohana 3.3.4
so a created a controller called admin:
<?php defined('SYSPATH') or die('No direct script access!');
class Controller_Admin extends Controller_Dev
{
public $template = 'login_template';
public function action_index()
{
if (Auth::instance()->logged_in()) {
$this->redirect->body('admin/dashboard', 302);
}
$this->redirect('admin/login');
}
//lets login user
public function action_login()
{
$view = new View('admin_login');
$this->template->title = "Log in";
if ($_POST) {
$user = ORM::factory('user');
$status = $user->login($_POST);
if ($status) {
$this->redirect('admin/dashboard', 302);
}
else {
$errors = $_POST->errors('admin/login');
}
}
// Display the login form
$this->template->content = $view;
}
//lets logout user
public function action_logout()
{
Auth::instance()->logout();
$this->redirect('admin/login', 302);
}
//lets register new users
public function action_register()
{
$view = View::factory('admin_register')
->set('values', $_POST)
->bind('errors', $errors);
$this->template->title = "Registration Page";
if ($_POST)
{
$user = ORM::factory('User');
// The ORM::values() method is a shortcut to assign many values at once
/* $external_values = array(
// The unhashed password is needed for comparing to the password_confirm field
'password' => Arr::get($_POST, 'password'),
// Add all external values
) + Arr::get($_POST, '_external', array());
$extra = Validation::factory($external_values)
->rule('confirm_password', 'matches', array(':validation', ':field', 'password')); */
try
{
//$test = $extra; //Arr::get($_POST, 'password');
//$view->test = $test;
$data = $this->request->post();
$user->register($data);
// Redirect the user to his page
$this->redirect('admin/login');
}
catch (ORM_Validation_Exception $e)
{
$errors = $e->errors('models');
}
}
$this->template->content = $view;
}
and i created a model called user to help me validate the new user account before save it to the database:
<?php defined('SYSPATH') or die('No direct access allowed.');
class Model_User extends Model_Auth_User {
//public $_table_name = 'users';
protected $_has_many = array(
'user_tokens' => array('model' => 'user_token'),
'roles' => array('model' => 'role', 'through', 'roles_users'),
// for facbook, google+, twitter and yahoo indentities
'user_identity' => array(),
);
protected $_ignored_columns = array('confirm_password');
public function rules()
{
return array(
'username' => array(
array('not_empty'),
array('min_length', array(':value', 4)),
array('max_length', array(':value', 32)),
array(array($this, 'username_available')),
),
'password' => array(
'not_empty' => NULL,
'min_length' => array(5),
'max_length' => array(42),
),
'password_confirm' => array(
'matches' => array('password'),
),
'email' => array(
'not_empty' => NULL,
'min_length' => array(4),
'max_length' => array(127),
'email' => NULL,
),
);
}
public function filters()
{
return array(
'password' => array(
array(array($this, 'hash_password')),
),
);
}
public function username_available($username)
{
// There are simpler ways to do this, but I will use ORM for the sake of the example
//return ORM::factory('Member', array('username' => $username))->loaded();
// Check if the username already exists in the database
return ! DB::select(array(DB::expr('COUNT(username)'), 'total'))
->from('users')
->where('username', '=', $username)
->execute()
->get('total');
}
public function hash_password($password)
{
// Do something to hash the password
}
public function register($array)
{
$this->values($array);
$this->save();
// Create a new user record in the database
// Save the new user id to a cookie
cookie::set('user', $id);
return $id;
}
}
When i visit the admin registration page. it fails displaying an error which says:
ErrorException [ Warning ]: call_user_func_array() expects parameter 1 to be a valid callback, no array or string given
so please help me out because i think i might be missing something. Thanks in advance guys. Am using Kohana 3.3.4
I had the same error recently. You need to change line:
array(array($this, 'username_available')),
to line (for username):
array(array($this, 'unique'), array('username', ':value')),
as stated in https://kohanaframework.org/3.3/guide-api/Model_Auth_User#rules
I hope this helps you.

cakePHP class blowfishpasswordhasher not found

I am trying to implement blowfish password hasher in my cakePHP app. I've followed along with the tutorial.
When trying to add a new user I'm getting a fatal error when I try to instantiate a new BlowfishPasswordHasher class in the beforeFilter function of my user model. The error states :Class 'BlowfishPasswordHasher' not found.
I saw the question here but it looks like I have everything setup correctly.
Here is relevant code in my app/Controller/appController:
class AppController extends Controller {
public $components = array(
'Flash',
'RequestHandler',
'Auth' => array(
'authenticate' => array(
'Form' =>array(
'passwordHasher' => 'Blowfish'
'fields' => array(
'username' => 'username',
'password' => 'password'
),
),
),
'loginRedirect' => '/trails',
'logoutRedirect' => '/',
),
);
app/Model/User.php
<?php
App::uses('AppModel', 'Model');
App::uses('BlowfishPasswordHasher', 'Conroller/Component/Auth');
class User extends AppModel {
public function beforeSave($options = array()) {
if (isset($this->data[$this->alias]['password'])) {
$passwordHasher = new BlowfishPasswordHasher();
$this->data[$this->alias]['password'] = $passwordHasher->hash($this->data[$this->alias]['password']
);
}
return true;
}
Any help is much appreciated!!!
Looks like you have a spelling mistake:
App::uses('BlowfishPasswordHasher', 'Conroller/Component/Auth');
Change this to:
App::uses('BlowfishPasswordHasher', 'Controller/Component/Auth');
There's no folder called Conroller and therefore, it's unable to locate the BlowFish library file.
Hope this helps.

Can't login using AuthComponent in Cake php

I guess this is a silly question but I'm having trouble logging in to the restricted sections of a site I'm building in Cake.
For starting I see that the password string in $this->request->data['Usuario']['clave'] is not the same as the hashed string using SimplePasswordHasher in the beforeSave function at the model. I should also say that the model is not the default Users model, because I'm writing the application for spanish language and I didn't want to use the default model, so my configuration of the component is:
class AppController extends Controller {
/*function beforeFilter() {
date_default_timezone_set('America/Mexico_City');
}*/
public $components = array(
'Session',
'Auth' => array(
'Form'=>array(
'userModel' => 'Usuario',
'unauthorizedRedirect' => false,
'loginRedirect' => array(
'controller' => 'ComplejosResidenciales',
'action' => 'index'
),
'logOutRedirect' => array(
'controller' => 'Usuarios',
'action' => 'index'
),
'fields' => array(
'username' => 'usuario',
'password' => 'clave'
),
'authorize' => 'Controller'
)
)
);
}
So I decided not to hash the password field, but still to no avail.
I wish anyone could lend me a hand on this because I'm newbie to CakePHP and don't know how to fix it.
I figure it must be something with the Auth->login() method because I'm not following conventions here, but I don't know how to configure the said method. Currently is like follows:
public function login() {
if($this->request->is('post')) {
if($this->Auth->login()) {
return $this->Auth->redirectUrl($this->Auth->redirectUrl());
}
else {
$this->Session->setFlash(__('Las credenciales proporcionadas no son correctas'), 'default', array(), 'auth');
}
As rrd pointed, my $components array was wrong, so I changed it to:
public $components = array(
'Session',
'Auth'=>array('loginRedirect'=>array('controller'=>'ComplejosResidenciales', 'action'=>'index'), 'logOutRedirect'=>array('controller'=>'Usuarios', 'action'=>'index'), 'loginAction'=>array('controller'=>'Usuarios', 'action'=>'login'), 'authenticate'=>array('Form'=>array('userModel'=>'Usuario', 'fields'=>array('username'=>'usuario', 'password'=>'clave')))));
Which is better, according to cakephp.org
Do not put other Auth configuration keys (like authError, loginAction etc) within the authenticate or Form element. They should be at the same level as the authenticate key.
But it isn't working.
Been struggling with it and I can't get the hang of it, I wish someone would point out what I'm doing wrong. In my AppController I have declared the component and the beforeFilter function like this:
public $components = array('Auth'=>array('loginRedirect'=>array('controller'=>'ComplejosResidenciales', 'action'=>'index'),
'logoutRedirect'=>array('controller'=>'Usuarios', 'action'=>'login'),
), 'Session');
public function beforeFilter(){
$this->Auth->authenticate = array(
AuthComponent::ALL => array('userModel' => 'Usuario', "fields" => array("username" => "usuario", "password" => "clave"), 'Form'));
}
And then I have the login function which goes (obviously I guess) in the UsuariosController, like this:
public function login() {
if($this->request->is('post')) {
if($this->Auth->login()) {
return $this->Auth->redirectUrl($this->Auth->loginRedirect);
}
else {
$this->Session->setFlash(__('Las credenciales proporcionadas no son correctas'), 'default', array(), 'auth');
}
}
}
But I just keep seeing the message "Las credenciales proporcionadas no son correctas". I don't know if I'm calling the method of Auth component correctly in the part $this->Auth->login() because apparently I have no result when calling it like that, without arguments, but I tried calling it with the argument $this->request->data and as a result it didn't mattered what I wrote in the username and password fields, anything would pass, which is bad, of course.
Now I see why coding $this->Auth->login($this->request->data) resulted in giving unrestricted access:
In 2.x $this->Auth->login($this->request->data) will log the user in with whatever data is posted, whereas in 1.3 $this->Auth->login($this->data) would try to identify the user first and only log in when successful.
According to cake's manual. I can't seem to read correctly any document about this. Anyway, I beg someone would help me because I'm in a hurry here. After reading some other documents I guess that Auth component should handle everything correctly, as long as I provide the right configuration, so I've ended up doing a beforeFilter() call in the AppController, like this:
var $components = array('Auth', 'Session');
public function beforeFilter() {
$this->Auth->loginAction = array('controller'=>'Usuarios', 'action'=>'login');
$this->Auth->redirectLogin = array('controller'=>'ComplejosResidenciales', 'action'=>'add');
$this->Auth->authenticate = array('Form'=>array('userModel'=>'Usuario', 'fields'=>array('username'=>'usuario', 'password'=>'clave')));
}
Then, in my "UsuariosController" I do:
public function beforeFilter() {
parent::beforeFilter();
$this->Auth->allow('index', 'view', 'add', 'edit', 'delete');
}
And I have my login and logout functions, very simple, but it's not working, and it does not redirect me upon logging in nor does it let me access any other controller, it seems to do nothing. Please help!
/**
* login and logout functions
*
*/
public function login() {
}
public function logout() {
$this->redirect($this->Auth->logout());
}
You should change more things.
$components should be something like this:
public $components = array(
'Session',
'Auth' => array(
'authenticate' => array(
'Form' => array(
'fields' => array('username'=>'usuario', 'password'=>'clave')
)
)
)
);
I am not sure about userModel, check the manual.
Than you should implement isAuthorized
function isAuthorized($user){
if(in_array($this->action, array('view', 'edit')))
return true;
return false;
}
beforeFilter is not necessary for your case.
Your login method is something like this.
public function login() {
if ($this->request->is('post')) {
if ($this->Auth->login()) {
return $this->redirect($this->Auth->redirectUrl());
}
else {
$this->Session->setFlash(__('Username or password is incorrect'), 'default', array(), 'auth');
}
}
}
Again, I recommend you to read the manual or the book mentioned above. It has a free sample, I think You will get the main idea by that.

LdapAuth in cakephp 2.0

i try to program a LdapAuthentication and i need some help.
First i need to configure the "$components" in /app/Controller/
Component/AppController.php
<?php
class AppController extends Controller {
var $components = array('Auth' => array(
'Ldap',
'authError' => 'Not allowed here',
'authenticate' => array('Form' => array(
'fields' => array(
'username' => 'username',
'password' => 'password',
'domain' => 'domain'
)
)
),
'authorize' => true,
), 'Session');
}
?>
Then i create a LdapAuthorize.php like
http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html#creating-custom-authorize-objects
<?php
App::uses('BaseAuthorize', 'Controller/Component/Auth');
class LdapAuthorize extends BaseAuthorize {
public function authorize($user, CakeRequest $request) {
echo "test";
}
}
?>
But when i try to login with
if ($this->Auth->login()) {
return $this->redirect($this->Auth->redirect());
} else {
$this->Session->setFlash(__('Username or password is incorrect'),
'default', array(), 'auth');
}
cakephp doesn't use my authorize function.
What i do wrong? Please help.
Here is a working Ldap Auth class for 2.0.x
https://github.com/analogrithems/idbroker/tree/dev_cake2.0
with a blog post detailing it here:
http://www.analogrithems.com/rant/2012/01/03/cakephp-2-0-ldapauth/
** ALSO **
Your Auth configuration is wrong - the authorize key takes a string or array - a boolean true isn't going to do anything.
If you want it to check an isAuthorized action in the controller - set it like so:
<?php
...
public $components = array( 'Auth' => array(
...
'authorize' => array( 'Controller' ),
...
));
?>
You are passing a boolean parameter here, and have no isAuthorized function in your AppController. Also, you are using old php4 syntax to declare your member variables (use public, protected or private instead of "var")

Categories