tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 12:05:37 +00:00
Code Issues Projects Releases Wiki Activity

FEATURE: Moved the log-in validation process from individual authenticators into Member->checkPassword() and canLogIn(), to allow more extensibility and control (trunk, 2.4).

Browse Source 
MINOR: Use a ValidationResult to log in a member so that custom errors can be generated.

From: Andrew Short <andrewjshort@gmail.com>

git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/trunk@98267 467b73ca-7a2a-4603-9d3b-597d59a354a9
This commit is contained in:
Andrew Short 2010-02-05 00:36:25 +00:00 committed by Sam Minnee
parent fda7836aca
commit 5e9b78b798
2 changed files with 49 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
security/Member.php
View File

@ -129,15 +129,14 @@ class Member extends DataObject {
} }
/** /**
* Check if the passed password matches the stored one * Check if the passed password matches the stored one (if the member is not locked out).
* *
* @param string $password The clear text password to check * @param string $password
* @return bool Returns TRUE if the passed password is valid, otherwise FALSE. * @return ValidationResult
*/ */
public function checkPassword($password) { public function checkPassword($password) {
// Only confirm that the password matches if the user isn't locked out $result = $this->canLogIn();
if($this->isLockedOut()) return false;
$spec = Security::encrypt_password( $spec = Security::encrypt_password(
$password, $password,
$this->Salt, $this->Salt,
@ -145,10 +144,40 @@ class Member extends DataObject {
$this $this
); );
$e = $spec['encryptor']; $e = $spec['encryptor'];
return $e->compare($this->Password, $spec['password']); if(!$e->compare($this->Password, $spec['password'])) {
$result->error(_t (
'Member.ERRORWRONGCRED',
'That doesn\'t seem to be the right e-mail address or password. Please try again.'
));
}
return $result;
} }
/**
* Returns a valid {@link ValidationResult} if this member can currently log in, or an invalid
* one with error messages to display if the member is locked out.
*
* You can hook into this with a "canLogIn" method on an attached extension.
*
* @return ValidationResult
*/
public function canLogIn() {
$result = new ValidationResult();
if($this->isLockedOut()) {
$result->error(_t (
'Member.ERRORLOCKEDOUT',
'Your account has been temporarily disabled because of too many failed attempts at ' .
'logging in. Please try again in 20 minutes.'
));
}
$this->extend('canLogIn', $result);
return $result;
}
/** /**
* Returns true if this user is locked out * Returns true if this user is locked out
*/ */

29
security/MemberAuthenticator.php Normal file → Executable file
View File

@ -32,6 +32,7 @@ class MemberAuthenticator extends Authenticator {
public static function authenticate($RAW_data, Form $form = null) { public static function authenticate($RAW_data, Form $form = null) {
$SQL_user = Convert::raw2sql($RAW_data['Email']); $SQL_user = Convert::raw2sql($RAW_data['Email']);
$isLockedOut = false; $isLockedOut = false;
$result = null;
// Default login (see Security::setDefaultAdmin()) // Default login (see Security::setDefaultAdmin())
if(Security::check_default_admin($RAW_data['Email'], $RAW_data['Password'])) { if(Security::check_default_admin($RAW_data['Email'], $RAW_data['Password'])) {
@ -41,9 +42,9 @@ class MemberAuthenticator extends Authenticator {
"Member", "Member",
"\"Email\" = '$SQL_user' AND \"Password\" IS NOT NULL" "\"Email\" = '$SQL_user' AND \"Password\" IS NOT NULL"
); );
$result = $member->checkPassword($RAW_data['Password']);
if($member && ($member->checkPassword($RAW_data['Password']) == false)) {
if($member->isLockedOut()) $isLockedOut = true; if($member && !$result->valid()) {
$member->registerFailedLogin(); $member->registerFailedLogin();
$member = false; $member = false;
} }
@ -102,22 +103,14 @@ class MemberAuthenticator extends Authenticator {
$member->write(); $member->write();
} }
if($member) { if($member) {
Session::clear("BackURL"); Session::clear('BackURL');
} else if($isLockedOut) { } else {
if($form) $form->sessionMessage( if($form && $result) $form->sessionMessage($result->message(), 'bad');
_t('Member.ERRORLOCKEDOUT', "Your account has been temporarily disabled because of too many failed attempts at logging in. Please try again in 20 minutes."), }
"bad"
);
} else {
if($form) $form->sessionMessage(
_t('Member.ERRORWRONGCRED', "That doesn't seem to be the right e-mail address or password. Please try again."),
"bad"
);
}
return $member; return $member;
} }
/** /**