Cakephp Auth Component Tutorial Part 3

This is a three part series in understanding the basics of using Cakephp's Auth component. You will need to watch all three videos as they build on to each other by adding more functionality to the application.

Category:

Science & Technology

Tags:

• Cakephp
• Cakephp auth component
• Cakephp tutorial
• Cakephp video tutorial

[tyebillion]

Andrew, when I edit a user I think the password field's value is hashed and there is no value for the password_confirmation field. Also how would you force the username to be the current user when adding a new post?

[andrewperk]

@tyebillion You would need to make additional changes to edit a user and their password. The password_confirmation field is empty because there's nothing to pre-populate that field with from the database, there is no password_confirmation field in the DB. so the form field remains empty. The password field would show the hashed password because it does not store a plain password in the DB, it stores the hashed password. You cannot retrieve the user's plain password, nor should you for security.

[tyebillion]

@andrewperk Thanks. And my other question... how would you force the username... ?

[andrewperk]

@tyebillion Edit your posts add action, pass in only the logged in user instead of $users using $user = $this->Post->User->read(null, $this->Auth->user('id')); change the set method to user the 'user' variable instead of 'users' in the compact statement. Now in your view change the 'user_id' field to be a hidden field and make its value equal to the $user variable you passed from your controller like so: $this->Form->input('user_id', array('type'=>'hidden', 'value'=>$user['User']['id']))­;

[andrewperk]

@tyebillion Everytime you make a new post that post automatically belongs to the logged in user because you pass in the logged in user's id to the form which is then saved with the post in the user_id field. I hope this makes sense.

[endesigner]

Andrew, what is the keyboard you are using? I like the sound.

[andrewperk]

@endesigner I use a laptop, so its the standard laptop that comes with the gateway p172s fx series laptop.

[andrewperk]

@benedictaluan In config/routes.php add a new line using the Router::connect(); The first parameter to the connect method is the string that you want your url to be. The second parameter is an array with key value pairs matching the exact location by controller and action. Router::connect('/add', array('controller'=>'users', 'action'=>'add')); You could easily make this say register instead of add.

[andrewperk]

@don9721 You are correct. To fix this security hole you have to use cakephp's Security component. Just enabling this component in your controller or appcontroller for sitewide protection will fix this problem. The security component will prevent form tampering, timeout, and csrf token protection as well. Some other security tips are that you don't have to worry about sql injection as long as you use cake's orm to do your queries. Also all helpers that output automatically escape for xss too.

[6thmercury]

can you please add a "forgot password" feature on this tutorial?

[tyebillion]

@andrewperk I found a similar solution to what you suggested. First I created a users_id variable in the app_controller, with value $this->Auth->user('id'). Then I created a hidden field in the add post view, replacing the existing input field with the code: echo $this->Form->hidden('user_id', array('value'=>$users_id)).

[tyebillion]

@andrewperk I found a similar solution to what you suggested. First I created a users_id variable in the app_controller, with value $this->Auth->user('id'). Then I created a hidden field in the add post view with the code: echo $this->Form->hidden('user_id', array('value'=>$users_id)).

[ysh5159]

Hi

do me a fever

Please send the files to my mail box 261129232@qq.com

thx!!!