Author: Pedro Lucas Porcellis <porcellis@eletrotupi.com>
auth: sanitize password and don't double cryptograph user password password_verify already do that without adding the salt info
app/controllers/AuthController.php | 13 ++++++++----- app/daos/UserDAO.php | 4 ++--
diff --git a/app/controllers/AuthController.php b/app/controllers/AuthController.php
index fda6afafaeb0ce30c28c87871e15afc910e8b91a..0548724182694cb30d470220b819ebb8b8fe8031 100644
--- a/app/controllers/AuthController.php
+++ b/app/controllers/AuthController.php
@@ -13,14 +13,17 @@ public function login() {
$email = $_POST['email'];
$password = $_POST['password'];
- $cryptographicPassword = password_hash($password, PASSWORD_DEFAULT);
+ $sanitizedPassword = htmlspecialchars($password);
+ $user = $this->authService->login($email, $sanitizedPassword);
- $user = $this->authService->login($email, $cryptographicPassword);
+ if ($user) {
+ $_SESSION['user_id'] = $user->getId();
+ $_SESSION['user_email'] = $user->getEmail();
- if ($user) {
- //$_SESSION['user_id'] = $user['id'];
- echo 'Usuário logado com sucesso';
+ header('Location: /dashboard');
+ exit();
} else {
+ // TODO: Flash messages
echo 'Usuário ou senha inválidos';
}
}
diff --git a/app/daos/UserDAO.php b/app/daos/UserDAO.php
index 8cb7b6985d14f1de8cabd7aac29cf4ba967a733e..b4f280614af57b66f3b7d59a3613cae96eed5e33 100644
--- a/app/daos/UserDAO.php
+++ b/app/daos/UserDAO.php
@@ -22,9 +22,9 @@
if ($userData) {
return new User(
$userData['id'],
- $userData['name'],
+ $userData['username'],
$userData['email'],
- $userData['password']
+ $userData['encrypted_password']
);
}