Author: Pedro Lucas Porcellis <porcellis@eletrotupi.com>
auth: sanitize password and don't double cryptograph user password password_verify already do that without adding the salt info
app/controllers/AuthController.php | 13 ++++++++----- app/daos/UserDAO.php | 4 ++--
diff --git a/app/controllers/AuthController.php b/app/controllers/AuthController.php index fda6afafaeb0ce30c28c87871e15afc910e8b91a..0548724182694cb30d470220b819ebb8b8fe8031 100644 --- a/app/controllers/AuthController.php +++ b/app/controllers/AuthController.php @@ -13,14 +13,17 @@ public function login() { $email = $_POST['email']; $password = $_POST['password']; - $cryptographicPassword = password_hash($password, PASSWORD_DEFAULT); + $sanitizedPassword = htmlspecialchars($password); + $user = $this->authService->login($email, $sanitizedPassword); - $user = $this->authService->login($email, $cryptographicPassword); + if ($user) { + $_SESSION['user_id'] = $user->getId(); + $_SESSION['user_email'] = $user->getEmail(); - if ($user) { - //$_SESSION['user_id'] = $user['id']; - echo 'Usuário logado com sucesso'; + header('Location: /dashboard'); + exit(); } else { + // TODO: Flash messages echo 'Usuário ou senha inválidos'; } } diff --git a/app/daos/UserDAO.php b/app/daos/UserDAO.php index 8cb7b6985d14f1de8cabd7aac29cf4ba967a733e..b4f280614af57b66f3b7d59a3613cae96eed5e33 100644 --- a/app/daos/UserDAO.php +++ b/app/daos/UserDAO.php @@ -22,9 +22,9 @@ if ($userData) { return new User( $userData['id'], - $userData['name'], + $userData['username'], $userData['email'], - $userData['password'] + $userData['encrypted_password'] ); }