I have used Auth component in my OrdersController as follows:
public $components = array(
'Session',
'Auth' => array(
'authenticate' => array(
'Form' => array(
'fields' => array(
'username' => 'email', //Default is 'username' in the userModel
'password' => 'password' //Default is 'password' in the userModel
),
'userModel' => 'Agent'
)
),
'loginAction' => array(
'controller' => 'admins',
'action' => 'login'
),
'loginRedirect' => array('controller' => 'admins', 'action' => 'deshboard'),
'logoutRedirect' => array('controller' => 'admins', 'action' => 'login'),
'authError' => "You can't acces that page",
'authorize' => 'Controller'
)
);
public function beforeFilter() {
parent::beforeFilter();
// Allow users to register and logout.
$this->Auth->allow('login','index');
}
When I tried to login and username and password matched it redirect to adminc/deshboard with the following error message:
$controller does not implement an isAuthorized() method.
Error: An Internal Error Has Occurred.
I searched google for couple of hours no solution. What am I doing for this error? Thanks for your time.
You need to implement isAuthorized(), like so:
class OrdersController extends Controller {
//...
public function isAuthorized($user) {
//auth check
//return boolean
}
//...
}
See http://book.cakephp.org/2.0/en/tutorials-and-examples/blog-auth-example/auth.html for more info.
Related
I'm trying to make a simple login system for my users, but I can't figure out why it won't log me in, the Auth->login() method always returns FALSE (incorrect information) for some reason... might be something with password hashing.
I have cakePHP 2.5.2.
Here is a screenshot of my issue: ISSUE
My beforeSave() method in UsersController:
public function beforeSave($options = array()) {
$this->request->data['User']['password'] = Security::hash($this->request->data['User']['password']);
}
and the login() method:
function login() {
if ($this->request->is('post')) {
if ($this->Auth->login()) {
$this->Session->setFlash(__('You\'ve successfully logged in.' . ' <b>' . $this->Session->read('User.login') . '</b>'), 'alert', array(
'plugin' => 'BoostCake',
'class' => 'alert-success'
), 'success');
return $this->redirect($this->Auth->redirectUrl());
//// $this->redirect($this->Auth->redirectUrl());
} else {
// var_dump($this->Auth->user());
$this->Session->setFlash(__('Sorry, the information you\'ve entered is incorrect.'), 'alert', array(
'plugin' => 'BoostCake',
'class' => 'alert-danger'
), 'danger');
}
}
}
here's the Auth component:
public $components = array(
'Session',
'Auth' => array(
'loginRedirect' => array('controller' => 'pages', 'action' => 'home'),
'logoutRedirect' => array('controller' => 'pages', 'action' => 'home'),
'loginAction' => array('controller' => 'users', 'action' => 'login'),
'authError' => 'You are not authorized to access this page.',
'authenticate' => array(
'Form' => array(
'userModel'=>'User',
'fields' => array(
'username' => 'login',
'password'=>'password')
)
),
'flash' => array(
'element' => 'alert',
'key' => 'auth',
'params' => array(
'plugin' => 'BoostCake',
'class' => 'alert-danger'
)
),'authorize'=>array('Controller'),
)
,'DebugKit.Toolbar'
);
Yes it's incorrect I removed everything and it works I don't know how
Move your beforeSave method to your Model, not the Controller.
When saving data Cake looks for any functions that should run before inserting the data in your Model.
You will also need to create a new user (if you look in your database you should find that the password has been stored as plaintext because the hashing in the beforeSave would never have been called.
I think you should provide the Security::hash() function blowfish or set the app's internal salt to true.
Like this:
public function beforeSave($options = array()) {
$this->request->data['User']['password'] = Security::hash($this->request->data['User']['password'], null, true);
}
This is the way, the deprecated AuthComponent::password() function works.
Just tested it this way in my Cake App and it work's fine.
See http://api.cakephp.org/2.4/class-Security.html#_hash
Edit:
beforeSave() should be in the User's Model, not in the User's Controller
I am new to cakephp. I have a problom while login. With wrong name and password redirects to login home page.
UsersController.php
public function login() {
$this->layout = 'admin-login';
if ($this->request->is('post')) {
if ($this->Auth->login($this->request->data)) {
return $this->redirect($this->Auth->redirectUrl())
} else {
$this->Session->setFlash(__('Username or password is incorrect'), 'default', array(), 'auth');
}
}
}
AppController.php
public $components = array(
'Session',
'Auth' => array(
'loginRedirect' => array('controller' => 'users', 'action' => 'index'),
'logoutRedirect' => array('controller' => 'users', 'action' => 'login'),
'loginAction' => array('controller' => 'users', 'action' => 'login')
)
);
public function beforeFilter() {
$this->Auth->allow("login");
//$this->Auth->authorize = array('Controller');
$this->Auth->authenticate = array(
'Form' => array (
'scope' => array(
'User.is_active' => 1
)
)
);
}
public function isAuthorized($user) {
return true;
}
login.ctp
echo $this->Form->create('User');
echo $this->Form->input('username');
echo $this->Form->input('password');
echo $this->Form->submit(__('Submit');
echo $this->Form->end();
When i fill the wrong username & password & click on submit button it redirect to home page, Thanks.
You are using AuthComponent::login() wrong, you are only supposed to pass data to it in case you want to manually login a user, ie without automatic authentication.
If you want to use the components authentication functionality just call $this->Auth->login()
See also: http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html#identifying-users-and-logging-them-in
In 2.x $this->Auth->login($this->request->data) will log the user in with whatever data is posted, whereas in 1.3 $this->Auth->login($this->data) would try to identify the user first and only log in when successful.
usercontroller
public function beforeFilter() {
parent::beforeFilter();
$this->Auth->allow('login','logout');
}
public function login()
{
$this->layout= 'login';
if ($this->request->is('post')) {
if ($this->Auth->login()) {
$this->redirect('/users');
else {
$this->Session->setFlash(__('Invalid email or password, please try again'));
}
}
else{
if($this->Auth->loggedIn())
$this->redirect('index');
}
}
}
AppController
class AppController extends Controller {
public $components = array(
'Session',
'Auth' => array(
'authenticate' => array(
'Form' => array(
'userModel' => 'User',
'fields' => array(
'username' => 'user_name',
'password' => 'password'
)
)
),
'loginAction' => array('controller' => 'users', 'action' => 'login'),
'loginRedirect' => array('controller' => 'users', 'action' => 'dashboard'),
'logoutRedirect' => array('controller' => 'users', 'action' => 'login'),
'authError' => 'You don\'t have access here.',
/*
'loginAction' => array('controller' => 'users', 'action' => 'forgot_password'),
'loginRedirect' => array('controller' => 'users', 'action' => 'dashboard'),
'logoutRedirect' => array('controller' => 'users', 'action' => 'forgot_password'),
'authError' => 'You don\'t have access here.',
*/
),
);
Sorry - Hate to ask but I've spent hour's working this out and researching but havent had any luck.
CakePHP (running the latest version) seems to refuse to use the fields setting (So that I can use the email column in the database as the username). If I set it to 'email' which is the field I wish to use from the database it simply refuses to login stating incorrect details. Cant get any output from SQL in DebugKit for some reason. Although when it's set to username as per below it works fine just using a 'temp' column in the DB. I've tried putting it in the components var but had no luck with that either. What could I be doing wrong? Debug is on, cant see any errors in the log or browser.
The model does contain an email column.
Controller/AppController.php
class AppController extends Controller {
public $components = array(
'Session',
'DebugKit.Toolbar',
'Auth' => array(
'allow' => array('login','logout'),
'loginAction' => array('controller' => 'users', 'action' => 'login'),
'loginRedirect' => array('controller' => 'dashboard', 'action' => 'index'),
'authorize' => 'Controller'
)
);
function beforeFilter() {
Security::setHash('md5');
$this->Auth->authenticate = array(
'Form' => array(
'fields' => array(
'username' => 'username',
),
),
);
}
}
Controller/UserController.php
class UsersController extends AppController {
public $uses = array('User');
public function beforeFilter() {
parent::beforeFilter();
}
public function isAuthorized($user){
return true;
}
public function login() {
$this->layout = 'login';
if ($this->request->is('post')) {
if ($this->Auth->login()) {
$this->redirect($this->Auth->redirect());
} else {
$this->Session->setFlash('Invalid username or password, try again','flash_error');
}
}
}
public function logout() {
$this->layout = 'login';
$this->Session->setFlash('Successfully logged out!','flash_success');
$this->redirect($this->Auth->logout());
}
}
View/Users/login.ctp
<?php
$this->set('title_for_layout', 'Login');
echo $this->Session->flash();
echo $this->Session->flash('auth','flash_info');
echo $this->Form->create('User', array(
'action' => 'login'
));
echo $this->Form->input('username',array(
'between' => '<br/>',
'before' => '<p>',
'after' => '</p>',
'class' => 'text',
'label' => 'Email:'
));
echo $this->Form->input('password',array(
'between' => '<br/>',
'before' => '<p>',
'after' => '</p>',
'class' => 'text',
'label' => 'Password:'
));
echo $this->Form->submit('Login', array(
'class' => 'submit',
'before' => '<p>',
'after' => '</p>'
));
echo $this->Form->end();
?>
You need to change the name of the field on your form from username to email. Just setting the label to "email" is not enough.
echo $this->Form->input('email',array(
'between' => '<br/>',
'before' => '<p>',
'after' => '</p>',
'class' => 'text',
'label' => 'Email:'
Try updating the components code in your appController to add the authenticate values to the Auth array like this:
public $components = array(
'Session',
'DebugKit.Toolbar',
'Auth' => array(
'allow' => array('login','logout'),
'loginAction' => array('controller' => 'users', 'action' => 'login'),
'loginRedirect' => array('controller' => 'dashboard', 'action' => 'index'),
'authorize' => 'Controller',
'authenticate' => array(
'Form' => array(
'fields' => array('username' => 'email')
)
)
)
);
i am beginning with cakephp framework, i use auth to create a login form, at my appcontroller i add:
class AppController extends Controller {
public $components = array('Auth', 'Cookie');
public function beforeFilter(){
$this->Auth->authenticate = array(
'Form' => array(
'userModel' => 'User',
'fields' => array('name' => 'name', 'password' => 'password'),
)
);
$this->Auth->loginAction = array('controller' => 'TestOnlineSystem', 'action' => 'P001');
$this->Auth->loginRedirect = array('controller' => 'TestOnlineSystem', 'action' => 'index');
$this->Auth->loginError = 'Failed to login';
$this->Auth->authError = ' ';
}
}
but when i run TestOnlineSystem/P001 it auto redirect to users/login anh show message net controller usercontroller. How can i fix it, P001 is my login page
I agree with thaJeztah, try the standard config from http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html :
public $components = array(
'Auth' => array(
'loginAction' => array(
'controller' => 'TestOnlineSystem',
'action' => 'P001',
'plugin' => 'users'
)
)
);
and get rid of your beforeFilter().
I've searched through many posts on stackoverflow for an answer, and prehaps I'm just overlooking something, but I can't seem to get $this->Auth->login() to work. I've tried many different suggestions from other posts. I will try to be as thorough as possible when describing other methods I've tried.
I do have adding a user working. The MD5 hashing is working correctly. I hashed a password and then checked it using miracle salad md5 http://www.miraclesalad.com/webtools/md5.php
I do not use a salt for hashing. I use MD5 without a salt.
The database I'm using is Postgresql 9.0. I know some of the CakePhp magic doesn't work for all databases (or so I've been told).
app/Config/core.php
Configure::write('Security.level', 'medium');
/**
* A random string used in security hashing methods.
*/
Configure::write('Security.salt', '');
I was using Auth->fields to map password to user_password and username to user_name in the DB. user_password and user_name are the columns in the core_users table. I also had in the beforeFilter() method.
$this->Auth->fields = array('username' => 'user_name', 'password' => 'user_password');
app/Controller/AppController.php
class AppController extends Controller {
public $components = array(
'Session',
'Auth' => array(
'loginRedirect' => array('controller' => 'pages', 'action' => 'index'),
'logoutRedirect' => array('controller' => 'pages', 'action' => 'display', 'home'),
'loginAction' => array('admin' => false, 'controller' => 'CoreUsers', 'action' => 'login'),
/*'fields' => array('password' => 'user_password', 'username' => 'user_name'),*/
'userModel' => 'CoreUser'
)
);
public function beforeFilter() {
Security::setHash('md5');
$this->Auth->allow('login');
//debug($this->Auth);
}
}
I left the debugs in so you can see the order that they are processed and I will show you how they are printed.
app/Controller/CoreUsersController.php
public function login() {
Security::setHash('md5');
//debug($this->Auth);
if ($this->request->is('post')) {
debug(Security::hash($this->Auth->request->data['CoreUser']['user_password']));
debug($this->Auth);
debug(Configure::version());
debug($this->Auth->request->data['CoreUser']['user_password']);
debug($this->Auth->request->data['CoreUser']['user_name']);
if ($this->Auth->login()) {
debug($this->Auth->request->data['CoreUser']['user_password']);
$this->redirect($this->Auth->redirect());
} else {
debug($this->Auth->request->data['CoreUser']['user_password']);
$this->Session->setFlash(__('Invalid username or password, try again'));
}
}
}
public function logout() {
$this->redirect($this->Auth->logout());
}
app/Model/CoreUser.php
App::uses('AuthComponent', 'Controller/Component');
class CoreUser extends AppModel{
public $primaryKey = 'user_id';
public $sequence = 'core_user_id_seq';
public $name = 'CoreUser';
public $validate = array(
'user_name' => array(
'required' => array(
'rule' => array('notEmpty'),
'message' => 'User name is required'
)
),
'user_password' => array(
'required' => array(
'rule' => array('notEmpty'),
'message' => 'Password is required'
)
),
'privilege_id' => array(
'required' => array(
'rule' => array('notEmpty'),
'message' => 'Privilege ID is required'
),
'legalValues' => array(
'rule' => array('between',1,4),
'message' => 'Privilege must be between 1 and 4'
)
),
'user_initial' => array(
'required' => array(
'rule' => array('notEmpty'),
'message' => 'User initials is required'
)
),
'email' => array(
'rule' => array('email',true),
'message' => 'Email must have an \'#\' symbol and a domain e.g. .com'
)
);
public function beforeSave() {
Security::setHash('md5');
if (isset($this->data[$this->alias]['user_password'])) {
$this->data[$this->alias]['user_password'] = AuthComponent::password($this->data[$this->alias]['user_password']);
}
return true;
}
}
app/View/CoreUsers/login.ctp
<h3>Login</h3>
<div class="users form">
<?php echo $this->Session->flash('auth'); ?>
<?php echo $this->Form->create('CoreUser');?>
<fieldset>
<legend><?php echo __('Please enter your username and password'); ?></legend>
<?php
echo $this->Form->input('user_name');
echo $this->Form->input('user_password');
?>
</fieldset>
<?php echo $this->Form->end(__('Login'));?>
</div>
Debug output
All of these are from the CoreUsersController and going in order in which they are processed.
Hashed password. This is the same as what is in the DB, when I added the user.
'098f6bcd4621d373cade4e832627b4f6'
The Auth object
object(AuthComponent) {
components => array(
(int) 0 => 'Session',
(int) 1 => 'RequestHandler'
)
authenticate => array(
(int) 0 => 'Form'
)
authorize => false
ajaxLogin => null
flash => array(
'element' => 'default',
'key' => 'auth',
'params' => array()
)
loginAction => array(
'admin' => false,
'controller' => 'CoreUsers',
'action' => 'login'
)
loginRedirect => array(
'controller' => 'pages',
'action' => 'index'
)
logoutRedirect => array(
'controller' => 'pages',
'action' => 'display',
(int) 0 => 'home'
)
authError => 'You are not authorized to access that location.'
allowedActions => array(
(int) 0 => 'login'
)
request => object(CakeRequest) {
params => array(
'plugin' => null,
'controller' => 'CoreUsers',
'action' => 'login',
'named' => array(),
'pass' => array()
)
data => array(
'CoreUser' => array(
'user_name' => 'testy5',
'user_password' => 'test'
)
)
query => array()
url => 'CoreUsers/login'
base => '/cpm_v2_dev'
webroot => '/cpm_v2_dev/'
here => '/cpm_v2_dev/CoreUsers/login'
}
response => object(CakeResponse) {
}
settings => array(
'loginRedirect' => array(
'controller' => 'pages',
'action' => 'index'
),
'logoutRedirect' => array(
'controller' => 'pages',
'action' => 'display',
(int) 0 => 'home'
),
'loginAction' => array(
'admin' => false,
'controller' => 'CoreUsers',
'action' => 'login'
),
'userModel' => 'CoreUser'
)
userModel => 'CoreUser'
}
Version of CakePHP
'2.1.0'
Password before login() is called
'test'
Username before login() is called
'testy5'
Password after login() is called
'test'
Here is a quick list of things that I've read in other stackoverflow post that I've tried. Let me know if you need to me to elaborate.
1) I mapped username and password to the fields in the DB. It's where the comments are for fields. I also tried doing it in the beforeFilter() method. Using:
$this->Auth->fields = array('username' => 'user_name', 'password' => 'user_password');
In the login view the form was created as such:
$this->Form->input('username');
$this->Form->input('password');
2) I tried hashing the password manually before login like so:
$this->Auth->request->data['CoreUser']['password'] = Security::hash($this->Auth->request->data['CoreUser']['password'])
if ($this->Auth->login()) {
$this->redirect($this->Auth->redirect());
}
EDIT0
3) I just tried doing this as recommended by CakePHP 2.0 Auth Login not working
My AuthComponent now looks like this:
public $components = array(
'Session',
'Auth' => array(
'authenticate' => array(
'Form' => array(
'userModel' => 'CoreUser',
'fields' => array(
'username' => 'user_name',
'password' => 'user_password'
)
)
),
'loginRedirect' => array('controller' => 'pages', 'action' => 'index'),
'logoutRedirect' => array('controller' => 'pages', 'action' => 'display', 'home'),
'loginAction' => array('admin' => false, 'controller' => 'CoreUsers', 'action' => 'login')
)
);
I apologize if I didn't elaborate enough, or I made a mistake. I've been working on this for a couple of days and it has really drained me. I appreciate any help I may receive. Thanks!
What I ended up doing to solve this issue was following the tutorial exactly as CakePHP has it. I also upgraded to 2.1.2. I was running 2.1.0.
http://book.cakephp.org/2.0/en/tutorials-and-examples/blog-auth-example/auth.html
Then I slowly added the configurations I needed. For information about the Auth component I referenced:
http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html
Really what my problem was poor troubleshooting. I would make a bunch of changes rather than one at a time. I had my login.ctp view two different ways
$this->Form->input('username');
$this->Form->input('password');
and now it looks like this:
echo $this->Form->input('user_name');
echo $this->Form->Label('Password');
echo $this->Form->password('user_password');
The second version works.
EDIT0:
This is very important. Without a call to the AppController parent the login will not work.
class CoreUsersController extends AppController{
public $helpers = array('Html','Form');
public function beforeFilter() {
parent::beforeFilter();
}
The revision for the Auth component works:
public $components = array(
'Session',
'Auth' => array(
'authenticate' => array(
'Form' => array(
'userModel' => 'CoreUser',
'fields' => array(
'username' => 'user_name',
'password' => 'user_password'
)
)
),
'loginRedirect' => array('controller' => 'pages', 'action' => 'index'),
'logoutRedirect' => array('controller' => 'pages', 'action' => 'display', 'home'),
'loginAction' => array('admin' => false, 'controller' => 'CoreUsers', 'action' => 'login')
)
);
My salt is still an empty string:
Configure::write('Security.salt', '');
Setting the md5 hash is only needed in one place. It's not needed in beforeSave() in the model:
public function beforeFilter() {
Security::setHash('md5');
$this->Auth->allow('login','add');
}
beforeSave():
public function beforeSave() {
if (isset($this->data[$this->alias]['user_password'])) {
$this->data[$this->alias]['user_password'] = AuthComponent::password($this->data[$this->alias]['user_password']);
}
return true;
}
If you added the user directly in the db, the that's the problem. Even though you have an empty string in the config, it' using that in the salt algorithm rather than not using a salt. (This is probably a bad idea, but that's another issue).
Also, the Auth->password function is a wrapper for Security::hash() where the salt is always used. Use Security::hash($password, 'md5', false) instead. That will no salt the password when you save the user. However you will probably need to configure your Auth/login function to login without checking for a salt.
I'm positive that your problem is with the way you have configure Auth...the should work fine with your db.
I had the same error, I did a copy of a cakephp project and couldn't login on the new one. After weeks of searching for a correct answer I found that all I had to do was to change permissions on tmp folder. For an unknown reason when I copy folders some of them where copied with read only permissions.