[Security] Numeric passwords comparing bugfix #203
Conversation
…nction comparePasswords haven't been working properly for numeric (plaintype) passwords.
| @@ -77,6 +77,9 @@ abstract class BasePasswordEncoder implements PasswordEncoderInterface | |||
| */ | |||
| protected function comparePasswords($password1, $password2) | |||
| { | |||
| settype($password1, 'string'); | |||
There was a problem hiding this comment.
This is not used in other part of the framework AFAIK. You should probably cast it as a string using $password1 = (string) $password1 to be consistent with the code.
|
Can you explain why the password is not a string? I think we should fix this rather than changing the compare method. |
|
I'm using this configuration: and when I input credentials into login form I can see in the debug window that first parameter for Symfony\Component\Security\Core\Encoder::comparePasswords() is 12345 of integer type and the second '12345' of string type. So the method always returns false. |
|
Then we should cast the password to a string in the SecurityExtension when your users are set-up. |
|
IIUC, we can close this pull request and expect another one with a better fix? |
|
Yes, I'll close it. @petajaros, if you're not sure where to fix it in the SecurityExtension.php, please create a ticket on trac.symfony-project.org, and I'll fix it when I have time. |
|
I have made another one pull request with the right solution of the problem, I hope. |
…ion (yceruto, javiereguiluz) This PR was merged into the master branch. Discussion ---------- Use a modal window to confirm the blog post deletion This pull request finished symfony#202 by making some tweaks to the design of the delete dialog. **Before** We used the classic Yes/No dialog mostly used in Windows systems:  **After** I propose to use the Delete/Cancel dialog used in Apple systems, because it's more user friendly:  I've just tweaked this dialog contents. The rest of the pull request is the result of the great work made by @yceruto. Commits ------- 620162b Updated the styles for the latest changes 36e61c5 Use a modal window to confirm the blog post deletion 0a2e717 disable submit button on submit. fecb034 rename js file e07792d fixing file documentation db88d34 fixing file documentation c0aaf79 confirmation message using bootstrap modal a41db16 using short name and statements 0a8299f avoids a DOM query for 'body' and avoids the need to wait for DOM ready db98a4e check the show_confirmation_message value 86d4f1c using event delegation d731ee8 removed multi-purpose variables 775ddba removing old code 167e3a1 confirmation message now listen from submit event of the form fd91b05 Removed return statement and improving the code. 40e771d Fixing translation position f6aa107 feature symfony#191 Add confirmation message before to delete a post
Method comparePassword haven't been working for numeric (plaintype) passwords properly because inserted password was converted into integer type a and compared with stored password as a string type. Bugfix changes data type of passwords into string before comparing.