Authentication issues in Cakephp - cakephp-2.0

Question

I am new in CakePhp, I have a problem with logging in users,
I am using CakePhp 2.4, I hashed the password using blowfish here is the code for my User Model
App::uses('AppModel', 'Model');
App::uses('AuthComponent', 'Controller/Component');
App::uses('BlowfishPasswordHasher', 'Controller/Component/Auth');
/**
* User Model
*
*/
class User extends AppModel {
/**
* Validation rules
*
* #var array
*/
public $validate = array(
'username' => array(
'required' => array(
'rule' => array('notEmpty'),
'message' => 'A username is required'
)
),
'password' => array(
'alphanumeric' => array(
'rule' => array('alphanumeric'),
'message' => 'Password needs to be alphanumeric',
'allowEmpty' => false,
'required' => false,
//'last' => false, // Stop validation after this rule
//'on' => 'create', // Limit validation to 'create' or 'update' operations
),
/*'minlength' => array(
'rule' => array('minlength'),
//'message' => 'Your custom message here',
//'allowEmpty' => false,
//'required' => false,
//'last' => false, // Stop validation after this rule
//'on' => 'create', // Limit validation to 'create' or 'update' operations
),*/
),
'firstname' => array(
'notempty' => array(
'rule' => array('notempty'),
//'message' => 'Your custom message here',
//'allowEmpty' => false,
//'required' => false,
//'last' => false, // Stop validation after this rule
//'on' => 'create', // Limit validation to 'create' or 'update' operations
),
),
'middlename' => array(
'notempty' => array(
'rule' => array('notempty'),
//'message' => 'Your custom message here',
//'allowEmpty' => false,
//'required' => false,
//'last' => false, // Stop validation after this rule
//'on' => 'create', // Limit validation to 'create' or 'update' operations
),
),
'lastname' => array(
'notempty' => array(
'rule' => array('notempty'),
//'message' => 'Your custom message here',
//'allowEmpty' => false,
//'required' => false,
//'last' => false, // Stop validation after this rule
//'on' => 'create', // Limit validation to 'create' or 'update' operations
),
),
);
public function beforeSave($options = array()){
//Override beforeSave to set modified field to NULL
if(!empty($this->data[$this->alias]['modified']) || isset($this->data[$this->alias]['modified']))
unset($this->data[$this->alias]['modified']);
//Hash passwords before saving to database
if(!empty($this->data[$this->alias]['password']) || isset($this->data[$this->alias]['password'])){
$hashedPassword = Security::hash($this->data[$this->alias]['password'],"blowfish");
$this->data[$this->alias]['password'] = $hashedPassword;
}
return true;
}
}
now when i try to log in a user, thats where the problem arises,
even if I supply the wrong credentials
(a user that is not registered in the database),
the user would still be logged in. Here is my AppController
<?php
App::uses('Controller', 'Controller');
class AppController extends Controller {
public $components = array(
'DebugKit.Toolbar',
'Session',
'Auth' => array(
'authenticate' => array('Blowfish'),
'loginRedirect' => array('controller' => 'computers', 'action' => 'index'),
'logoutRedirect' => array('controller' => 'users', 'action' => 'index')
)
);
public function beforeFilter(){
$this->Auth->allow('index');
}
}
and here is my UsersController
<?php
App::uses('AppController', 'Controller');
/**
* Users Controller
*
* #property User $User
* #property PaginatorComponent $Paginator
* #property RequestHandlerComponent $RequestHandler
*/
class UsersController extends AppController {
/**
* Helpers
* #var array
*/
public $helpers = array('Session');
/**
* Components
* #var array
*/
public $components = array('Paginator', 'RequestHandler');
public function beforeFilter(){
parent::beforeFilter();
$this->Auth->allow(array('signup','check_user'));//Letting users register themselves
}
/**
* index method
* #return void
*/
public function index() {
$this->layout = 'custom_layouts/default';
$data = array(
'id' => 'myLayout',
'title_for_layout' => 'Reservation . Better Reservation'
);
$this->set($data);
/*
$this->User->recursive = 0;
$this->set('users', $this->Paginator->paginate());*/
}
public function login(){
if($this->request->is('post')){
if($this->Auth->login()){ return $this->redirect($this->Auth->redirectUrl()); }
$this->Session->setFlash(__('Invalid username or password, try again.'));
}
$this->layout = 'custom_layouts/default';
$data = array(
'id' => 'signin',
'title_for_layout' => 'Reservation . Sign in'
);
$this->set($data);
}
public function logout(){
return $this->redirect($this->Auth->logout());
}
/*
* signup method
* #return void
*/
public function signup(){
if($this->request->is('post')){
$this->User->create();
if($this->User->save($this->request->data)){
$this->Session->setFlash(__('Your Account has been successfully added.'));
return $this->redirect(array('action' => 'login'));
}
else{ $this->Session->setFlash(__('The user could not be saved. Please, try again.')); }
}
$this->layout = 'custom_layouts/default';
$data = array(
'id' => 'signup',
'title_for_layout' => 'Reservation . Sign up'
);
$this->set($data);
}
/*
* check_user method
* #return json
*/
public function check_user(){
$user = NULL;
if($this->request->is('get')){
$this->disableCache();
$ajax_query = $this->request->query('requested_user');
$isExisting = $this->User->find(
'first',
array(
'condition' => array(
'User.username' => $ajax_query
)
)
);
if($isExisting){
$user = $this->User->find(
'first',
array(
'fields' => array(
'User.username',
'User.firstname',
'User.lastname'
),
'conditions' => array('User.username' => $ajax_query)
)
);
}
$this->set('response', $user);
$this->set('_serialize','response');
}
}
//Baked methods
/**
* view method
*
* #throws NotFoundException
* #param string $id
* #return void
*/
/*
public function view($id = null) {
if (!$this->User->exists($id)) {
throw new NotFoundException(__('Invalid user'));
}
$options = array('conditions' => array('User.' . $this->User->primaryKey => $id));
$this->set('user', $this->User->find('first', $options));
}*/
/**
/*
* edit method
*
* #throws NotFoundException
* #param string $id
* #return void
*/
/*
public function edit($id = null) {
if (!$this->User->exists($id)) {
throw new NotFoundException(__('Invalid user'));
}
if ($this->request->is('post') || $this->request->is('put')) {
if ($this->User->save($this->request->data)) {
$this->Session->setFlash(__('The user has been saved.'));
return $this->redirect(array('action' => 'index'));
} else {
$this->Session->setFlash(__('The user could not be saved. Please, try again.'));
}
} else {
$options = array('conditions' => array('User.' . $this->User->primaryKey => $id));
$this->request->data = $this->User->find('first', $options);
}
}*/
/**
* delete method
*
* #throws NotFoundException
* #param string $id
* #return void
*/
/*
public function delete($id = null) {
$this->User->id = $id;
if (!$this->User->exists()) {
throw new NotFoundException(__('Invalid user'));
}
$this->request->onlyAllow('post', 'delete');
if ($this->User->delete()) {
$this->Session->setFlash(__('The user has been deleted.'));
} else {
$this->Session->setFlash(__('The user could not be deleted. Please, try again.'));
}
return $this->redirect(array('action' => 'index'));
}*/
}
I have done a lot of googling for a fix on this problem to no avail,
on the cakephp docs, I have read this note
In 2.x $this->Auth->login($this->request->data) will log the user in with whatever data is posted, whereas in 1.3 $this->Auth->login($this->data) would try to identify the user first and only log in when successful.
if this is the cause if why even if the user credentials supplied are not registered in the database, the user would still be authenticated, is there any kind of workaround for this one?

Answer 1

I think you should define userModel in appcontroller
'loginAction' => array('controller'=>'Admin', 'action'=>'login'),
'loginRedirect' => array('contoller'=>'Admin', 'action'=>'login'),
'logoutRedirect' => array('controller'=>'Admin', 'action'=>'logout'),
'authError' => '<div class="alert alert-error"><button type="button" class="close" data-dismiss="alert">×</button>
You are not authorized to access this location</div>',
'authenticate' => array(
'Form' => array(
'userModel' => 'User',
'fields' => array(
'username' => 'email',
'password'=>'password')
)
)
);