cakephp password validation

Question

var $validate = array(
  'password' => array(
      'passwordlength' => array('rule' => array('between', 8, 50),'message' => 'Enter 8-50 chars'),
      'passwordequal' => array('checkpasswords','message' => 'Passwords dont match') 
  )
);

function checkpasswords()
{
   return strcmp($this->data['Airline']['password'],$this->data['Airline']['confirm password']);
}

This code is not working and always gives the error message even if they match. Also when i do a edit i get the followoing error as there is no password field. is there any fix

Undefined index:  password [APP/models/airline.php, line 25]

Solution 1

here is the mistake

'passwordequal' => array('checkpasswords','message' => 'Passwords dont match') 

I changed it to

'passwordequal'  => array('rule' =>'checkpasswords','message' => 'Passwords dont match')

also strcmp function also had mistakes as it would return 0 (i.e False) all the time in the above code

if(strcmp($this->data['Airline']['password'],$this->data['Airline']['confirm_password']) ==0 )
{
    return true;
}
return false;

Solution 2

Are you using the AuthComponent? Be aware that it hashes all incoming password fields (but not "password confirm" fields, check with debug($this->data)), so the fields will never be the same. Read the manual and use AuthComponent::password to do the check.

---

Having said that, here's something I use:

public $validate = array(
    'password' => array(
        'confirm' => array(
            'rule' => array('password', 'password_control', 'confirm'),
            'message' => 'Repeat password',
            'last' => true
        ),
        'length' => array(
            'rule' => array('password', 'password_control', 'length'),
            'message' => 'At least 6 characters'
        )
    ),
    'password_control' => array(
        'notempty' => array(
            'rule' => array('notEmpty'),
            'allowEmpty' => false,
            'message' => 'Repeat password'
        )
    )
);

public function password($data, $controlField, $test) {
    if (!isset($this->data[$this->alias][$controlField])) {
        trigger_error('Password control field not set.');
        return false;
    }

    $field = key($data);
    $password = current($data);
    $controlPassword = $this->data[$this->alias][$controlField];

    switch ($test) {
        case 'confirm' :
            if ($password !== Security::hash($controlPassword, null, true)) {
                $this->invalidate($controlField, 'Repeat password');
                return false;
            }
            return true;

        case 'length' :
            return strlen($controlPassword) >= 6;

        default :
            trigger_error("Unknown password test '$test'.");
    }
}

This is bad for the following reasons:

• Has tight coupling to the form, always expects a field password_control to be present. You need to use field whitelisting or disable validation if you don't have one in your data, i.e.: $this->User->save($this->data, true, array('field1', 'field2')).
• Manually hashes the password the way the AuthComponent does (since there's no clean access to components from the model). If you change the algorithm used in the AuthComponent, you need to change it here as well.

Having said that, it transparently validates and produces proper error messages for both the password and password control fields without requiring any additional code in the controller.

Solution 3

For CakePHP 2.x users using Authentication you may note that "AuthComponent no longer automatically hashes every password it can find." I.e. the solutions above may not be the correct way of solving the problem for 2.x. http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html#hashing-passwords

Solution 4

Heres is my solution:

You must to make a method named match (You can name it what you like):

public function match($check, $with) {
    // Getting the keys of the parent field
    foreach ($check as $k => $v) {
        $$k = $v;
    }

    // Removing blank fields
    $check = trim($$k);
    $with = trim($this->data[$this->name][$with]);

    // If both arent empty we compare and return true or false
    if (!empty($check) && !empty($with)) {
        return $check == $with;
    }

    // Return false, some fields is empty
    return false;
}

And the $validate method must be like this:

public $validate = array(
    'password' => array(
        'match' => array(
            'rule' => array('match', 'password2'),
            'message' => 'Passwords doesnt match',
        ),
    ),
);

Where password2 is the field to compare your first password field

I'm Glad to share it! :D

View more solutions

Comments

[Stephen]

is $this->datadata intended? If not, there's your problem.

[Gromski]

strcmp returns 0 if the strings are equal. 0 will be understood as false, so it'll do the exact opposite of what you expect it to do.

[Tim]

Are you missing an underscore in 'confirm password' in your checkpassword-function?