Comments (11)
I found a quick work around for the moment:
The password property can be unset so that it is empty and not saved during the update. unset($user->password); // Required so Ardent doesn't rehash the already-hashed password
. This will prevent saving a double hashed password. Just use this before using $user->save();
when updating the user's info, unless you're intentionally trying to change the password field with new input.
So I don't know if this is something you guys still want to changed in Confide. I think it's probably still a good idea. The worry being that a developer could potentially destroy their user's password hashes if they get double hashed with this 'gotcha' when trying to update the user's info. But the above is a short term fix for anyone encountering this.
from confide.
Yeah thats how I've been doing it. If the confirmation password isn't set
it unsets both. I assume that if both are passed in, then its meant to be
set. Otherwise it's ignored.
On Mon, Apr 8, 2013 at 5:11 PM, Jason [email protected] wrote:
I found a quick work around for the moment:
The password property can be unset so that it is empty and not saved
during the update. unset($user->password); // Required so Ardent doesn't
rehash the already-hashed password. This will prevent saving a double
hashed password. Just use this before using $user->save(); when updating
the user's info, unless you're intentionally trying to change the password
field with new input.So I don't know if this is something you guys still want to changed in
Confide. I think it's probably still a good idea. The worry being that a
developer could potentially destroy their user's password hashes if they
get double hashed with this 'gotcha' when trying to update the user's info.
But the above is a short term fix for anyone encountering this.—
Reply to this email directly or view it on GitHubhttps://github.com//issues/59#issuecomment-16087015
.
from confide.
If the confirmation password isn't set
it unsets both. I assume that if both are passed in, then its meant to be
set. Otherwise it's ignored.
I don't think that's correct. For example, in my case the password confirmation is not set (given the data comes from the users table which doesn't have a column for the password confirmation). Yet the password property is not ignored and it does rehash the existing password hash, causing future login attempts for that user to fail.
To clarify, I don't recommend the unset method as a permanent solution (just as a temp fix for yesterday) because it leaves the unexpected behavior within Confide to trip up future Confide users. Whereas just using Hash::make() where needed within ConfideUser.php would solve this problem.
from confide.
Not in Confide. In my model for my application it unsets both the password and password_confirmation fields if they are not set. (It also fails validation if they don't match.) It doesn't rehash the password.
An alternative is to check if the hash is unmodified and if so, remove it from the update array. Of course that is tricky, because what if they entered the exact hash (unlikely I know) then password would not be reset when it should be.
from confide.
I'll need to figure out what the best way to remove and then add the hashing elsewhere.
from confide.
@andrew13 Any news on this? Does the purpose of the "amend" is to fix this?
from confide.
Amend does resolve this issue as far as I am concerned. Closing.
from confide.
@andrew13 What do you mean by 'Amend'? Can you link to it or to the commit that fixes this please? So I can see what you guys are referring to and can figure out how to change my own code as well. Thx.
from confide.
See https://github.com/Zizaco/confide#update-an-user
from confide.
Thanks
from confide.
No problem
from confide.
Related Issues (20)
- Too many assumptions that email implies a unique user - it seldom does in mature systems
- Serialization of 'Closure' is not allowed HOT 6
- Email subject in config HOT 2
- hash method and user data migrate
- How to set my own view for password reset? HOT 1
- Laravel 5 Support? HOT 3
- SMS registration HOT 1
- Deactivate user? HOT 2
- erroneous error: The credentials provided have already been used. Try with different credentials HOT 1
- Getting wrong confirmation code while registering with username and email id containing dot(.)
- composer update for laravel 5 does not work HOT 4
- 5.0.x-dev: Missing file 'tests/Confide/helpers.php' throws Fatal error during `artisan clear-compiled` HOT 1
- When I create file with using '$ php artisan confide:migration', that file's path is wrong.
- Username not accepting "." HOT 1
- Support for Laravel 5.1 HOT 2
- Confide 4.3 is full of bug HOT 1
- Class 'Zizaco\Confide\UserValidator' not found
- Wrong confirmation code
- Warning: Ambiguous class resolution, "ConfideSetupUsersTable"
- laravel 5.1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from confide.