Yii2 用户登录，Yii2用户登录
在Yii2的basic版本中默认是从一个数组验证用户名和密码，如何改为从数据表中查询验证呢？且数据库的密码要为哈希加密密码验证？
下面我们就一步一步解析Yii2的登录过程。
一. 创建user表模型
表结构如下：
CREATE TABLE `user` ( `id` int(11) NOT NULL AUTO_INCREMENT, `pid` int(11) NOT NULL DEFAULT '0' COMMENT '父id', `username` char(70) NOT NULL COMMENT '用户名', `password` char(70) NOT NULL COMMENT '密码', `type` tinyint(4) NOT NULL DEFAULT '4' COMMENT '类型(1:总店,2:门店,3:管理员)', `created_time` int(11) NOT NULL COMMENT '注册时间', `updated_time` int(11) NOT NULL COMMENT '修改时间', `status` tinyint(4) NOT NULL DEFAULT '1' COMMENT '封禁状态，0禁止1正常', `login_ip` char(20) NOT NULL COMMENT '登录ip', `login_time` int(11) NOT NULL COMMENT '上一次登录时间', `login_count` int(10) NOT NULL DEFAULT '0' COMMENT '登陆次数', `update_password` int(10) NOT NULL DEFAULT '0' COMMENT '修改密码次数', PRIMARY KEY (`id`), KEY `pid` (`pid`), KEY `username` (`username`), KEY `type` (`type`), KEY `status` (`status`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='登录管理表';
使用Gii创建user模型
将Yii2 basic之前user模型代码导入现在user中（先备份之前basic中的user模型）
1 namespace app\models;
2
3 use Yii;
4
5 /**
6 * This is the model class for table "user".
7 *
8 * @property integer $id
9 * @property integer $pid
10 * @property string $username
11 * @property string $password
12 * @property integer $type
13 * @property integer $created_time
14 * @property integer $updated_time
15 * @property integer $status
16 * @property string $login_ip
17 * @property integer $login_time
18 * @property integer $login_count
19 * @property integer $update_password
20 */
21 class User extends \yii\db\ActiveRecord implements \yii\web\IdentityInterface
22 { public $authKey;
23 /*public $id;
24 public $username;
25 public $password;
26 public $authKey;
27 public $accessToken;
28
29 private static $users = [
30 '100' => [
31 'id' => '100',
32 'username' => 'admin',
33 'password' => 'admin',
34 'authKey' => 'test100key',
35 'accessToken' => '100-token',
36 ],
37 '101' => [
38 'id' => '101',
39 'username' => 'demo',
40 'password' => 'demo',
41 'authKey' => 'test101key',
42 'accessToken' => '101-token',
43 ],
44 ];
45 */
46
47 /**
48 * @inheritdoc
49 */
50 public static function tableName()
51 {
52 return 'user';
53 }
54
55 /**
56 * @inheritdoc
57 */
58 public function rules()
59 {
60 return [
61 [['pid', 'type', 'created_time', 'updated_time', 'status', 'login_time', 'login_count', 'update_password'], 'integer'],
62 [['username', 'password', 'created_time', 'updated_time', 'login_ip', 'login_time'], 'required'],
63 [['username', 'password'], 'string', 'max' => 70],
64 [['login_ip'], 'string', 'max' => 20]
65 ];
66 }
67
68 /**
69 * @inheritdoc
70 */
71 public function attributeLabels()
72 {
73 return [
74 'id' => 'ID',
75 'pid' => 'Pid',
76 'username' => 'Username',
77 'password' => 'Password',
78 'type' => 'Type',
79 'created_time' => 'Created Time',
80 'updated_time' => 'Updated Time',
81 'status' => 'Status',
82 'login_ip' => 'Login Ip',
83 'login_time' => 'Login Time',
84 'login_count' => 'Login Count',
85 'update_password' => 'Update Password',
86 ];
87 }
88
89 /**
90 * @inheritdoc
91 */
92 public static function findIdentity($id)
93 {
94 return static::findOne($id);
95 //return isset(self::$users[$id]) ? new static(self::$users[$id]) : null;
96 }
97
98 /**
99 * @inheritdoc
100 */
101 public static function findIdentityByAccessToken($token, $type = null)
102 {
103 return static::findOne(['access_token' => $token]);
104 /*foreach (self::$users as $user) {
105 if ($user['accessToken'] === $token) {
106 return new static($user);
107 }
108 }
109
110 return null;*/
111 }
112
113 /**
114 * Finds user by username
115 *
116 * @param string $username
117 * @return static|null
118 */
119 public static function findByUsername($username)
120 {
121 $user = User::find()
122 ->where(['username' => $username])
123 ->asArray()
124 ->one();
125
126 if($user){
127 return new static($user);
128 }
129
130 return null;
131 /*foreach (self::$users as $user) {
132 if (strcasecmp($user['username'], $username) === 0) {
133 return new static($user);
134 }
135 }
136
137 return null;*/
138 }
139
140 /**
141 * @inheritdoc
142 */
143 public function getId()
144 {
145 return $this->id;
146 }
147
148 /**
149 * @inheritdoc
150 */
151 public function getAuthKey()
152 {
153 return $this->authKey;
154 }
155
156 /**
157 * @inheritdoc
158 */
159 public function validateAuthKey($authKey)
160 {
161 return $this->authKey === $authKey;
162 }
163
164 /**
165 * Validates password
166 *
167 * @param string $password password to validate
168 * @return boolean if password provided is valid for current user
169 */
170 public function validatePassword($password)
171 {
172 return $this->password === $password;
173 }
174 }
之前的basic中User模型是继承了\yii\base\Object，为什么要继承这个类，那是因为
1 #在\yii\base\Object中，有构造方法
2 public function __construct($config = [])
3 {
4 if (!empty($config)) {
5 Yii::configure($this, $config);
6 }
7 $this->init();
8 }
9 #继续追踪Yii::configure($this, $config)代码如下
10 public static function configure($object, $properties)
11 {
12 foreach ($properties as $name => $value) {
13 $object->$name = $value;
14 }
15
16 return $object;
17 }
18 #正是因为有这两个方法，所以在User.php中
19 public static function findByUsername($username)
20 {
21 foreach (self::$users as $user) {
22 if (strcasecmp($user['username'], $username) === 0) {
23 return new static($user);
24 }
25 }
26
27 return null;
28 }
29 #将$user传递过来，通过static，返回一个User的实例。
当通过数据表查询时候没有必要再继承\yii\base\Object，因为不必为类似原来类变量赋值了。这个时候需要User模型继承\yii\db\ActiveRecord，因为要查询用。
findIdentity是根据传递的id返回对应的用户信息，getId返回用户id，getAuthKey和validateAuthKey是作用于登陆中的--记住我。这个authKey是唯一的，当再次登陆时，从cookie中获取authKey传递给validateAuthKey，验证通过，就登陆成功。
二. 模拟用户数据登录
插入一条用户模拟数据
INSERT INTO `user` (`username`, `password`) VALUES ('admin', '123')
控制器Controller
1 /**
2 * 登录
3 */
4 public function actionLogin() {
5 if (!\Yii::$app->user->isGuest) {
6 return $this->goHome();
7 }
8
9 $model = new LoginForm();
10 if ($model->load(Yii::$app->request->post()) && $model->login()) {
11
12
13 $this->redirect(array('charisma/index'));
14 } else {
15 return $this->render('login', [
16 'model' => $model,
17 ]);
18 }
19 }
veiws中的login.php
1 <div class="well col-md-5 center login-box">
2 <div class="alert alert-info">
3 请填写您的用户名和密码
4 </div>
5
6 <?php $form = ActiveForm::begin([
7 'id' => 'login-form',
8 ]); ?>
9
10 <fieldset>
11 <div class="input-group input-group-lg">
12 <span class="input-group-addon"><i class="glyphicon glyphicon-user red"></i></span>
13 <?php echo Html::input('type','LoginForm[username]', $model->username, ['class'=>'form-control','placeholder'=>'Username']); ?>
14 </div>
15 <div class="clearfix"></div><br>
16 <div class="input-group input-group-lg">
17 <span class="input-group-addon"><i class="glyphicon glyphicon-lock red"></i></span>
18 <?php echo Html::input('password','LoginForm[password]', $model->password, ['class'=>'form-control','placeholder'=>'Password']); ?>
19 </div>
20 <div class="clearfix"></div>
21
22 <div class="clearfix"></div>
23 <p class="center col-md-5">
24 <input type="submit" class="btn btn-primary" value="Login">
25 </p>
26 </fieldset>
27 <?php ActiveForm::end();?>
28
29 <?php
30 if($model->errors){
31 echo '用户名或密码错误';
32 print_r($model->errors);
33 }
34
35
36
37 ?>
38
39 </div>
用户名admin， 密码123， 登录ok！
问题来了，我们使用的是明文保存的密码，这样很不安全，所以我们必须要把用户注册时的密码哈希加密后再保存到数据库。
三. Yii的密码加密
YII2对密码加密生成的结果是不同的，即用相同的初始密码在不同时间得到的加密结果不同，所以我们不能用常用的方法去验证密码是否正确（将密码加密后与数据库中的密码相比较）。YII2有自己的加密以及密码验证流程。
加密
$hash = Yii::$app->getSecurity()->generatePasswordHash('123456');
验证
Yii::$app->getSecurity()->validatePassword('123456', $hash) ; #,返回true或false
我们先通过Yii的加密机制加密 “123” 获取哈希密码为： $2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy
修改模拟数据admin的密码：
UPDATE `user` SET `password`='$2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy' WHERE (`username`='admin')
四.密码验证过程
在控制器中我们通过 实例化LoginForm，
Yii::$app->request->post()来获取post提交的值，通过$model->load()加载post数据
然后$model->login() 就是验证登录
$model = new LoginForm();
if ($model->load(Yii::$app->request->post()) && $model->login()) {
$this->redirect(array('charisma/index'));
}
我们跳转到app\models\LoginForm的login方法
public function login()
{
if ($this->validate()) {
return Yii::$app->user->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0);
} else {
return false;
}
}
login方法又是通过一个validate验证方法 继承vendor/yiisoft/yii2/base/Model.php
该验证方法描述是这样的：Performs the data validation. This method executes the validation rules applicable to the current [[scenario]]. The following criteria are used to determine whether a rule is currently applicable: - the rule must be associated with the attributes relevant to the current scenario; - the rules must be effective for the current scenario. This method will call [[beforeValidate()]] and [[afterValidate()]] before and after the actual validation, respectively. If [[beforeValidate()]] returns false, the validation will be cancelled and [[afterValidate()]] will not be called. Errors found during the validation can be retrieved via [[getErrors()]], [[getFirstErrors()]] and [[getFirstError()]].
我们打开model类的validate()
public function validate($attributeNames = null, $clearErrors = true)
{
if ($clearErrors) {
$this->clearErrors();
}
if (!$this->beforeValidate()) {
return false;
}
$scenarios = $this->scenarios();
$scenario = $this->getScenario();
if (!isset($scenarios[$scenario])) {
throw new InvalidParamException("Unknown scenario: $scenario");
}
if ($attributeNames === null) {
$attributeNames = $this->activeAttributes();
}
foreach ($this->getActiveValidators() as $validator) {
$validator->validateAttributes($this, $attributeNames);
}
$this->afterValidate();
return !$this->hasErrors();
}
也就是说获取到场景且没有错误的话，将场景yii\validators\RequiredValidator Object的每一个属性实例化为对应Form规则（rules）实例
foreach ($this->getActiveValidators() as $validator) {
$validator->validateAttributes($this, $attributeNames);
}
现在找到LoginForm的验证规则
/**
* @return array the validation rules.
*/
public function rules()
{
return [
// username and password are both required
[['username', 'password'], 'required'],
// rememberMe must be a boolean value
['rememberMe', 'boolean'],
// password is validated by validatePassword()
['password', 'validatePassword'],
];
}
其中username,password 必填， rememberMe为波尔类型， password通过ValidatePassword方法来验证
查看validatePassword方法
/**
* Validates the password.
* This method serves as the inline validation for password.
*
* @param string $attribute the attribute currently being validated
* @param array $params the additional name-value pairs given in the rule
*/
public function validatePassword($attribute, $params)
{
if (!$this->hasErrors()) {
$user = $this->getUser();
if (!$user || !$user->validatePassword($this->password)) {
$this->addError($attribute, 'Incorrect username or password.');
}
}
}
首先$this->getUser()会判断在user表中是否有username=“admin”，如果存在就返回一个user的实例
public static function findByUsername($username) {
$user = User::find()
->where(['username' => $username])
->asArray()
->one();
if ($user) {
return new static($user);
}
return null;
}
通过$user->validatePassword($this->password) 判断验证密码，这个是最关键的一步
因为之前通过$this->getUser 已经实例化了user表，所以validatePassword在User模型的原始代码是这样的
/**
* Validates password
*
* @param string $password password to validate
* @return boolean if password provided is valid for current user
*/
public function validatePassword($password) {
return $this->password === $password;
}
获取用户输入的密码， 再和数据库中的密码做对比，如果密码相同就通过验证。
现在我们已经把密码123改为哈希密码：$2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy
所以要通过Yii2 自带的验证 Yii::$app->getSecurity()->validatePassword('123456', $hash) ; 进行验证
所以validatePassword方法的代码应该修改如下：
/**
* Validates password
*
* @param string $password password to validate
* @return boolean if password provided is valid for current user
*/
public function validatePassword($password) {
return Yii::$app->getSecurity()->validatePassword($password, $this->password);
}
完整的LoginForm模型和User模型代码如下：
1 <?php
2
3 namespace app\models;
4
5 use Yii;
6 use yii\base\Model;
7
8 /**
9 * LoginForm is the model behind the login form.
10 */
11 class LoginForm extends Model
12 {
13 public $username;
14 public $password;
15 public $rememberMe = true;
16
17 private $_user = false;
18
19
20 /**
21 * @return array the validation rules.
22 */
23 public function rules()
24 {
25 return [
26 // username and password are both required
27 [['username', 'password'], 'required'],
28 // rememberMe must be a boolean value
29 ['rememberMe', 'boolean'],
30 // password is validated by validatePassword()
31 ['password', 'validatePassword'],
32 ];
33 }
34
35 /**
36 * Validates the password.
37 * This method serves as the inline validation for password.
38 *
39 * @param string $attribute the attribute currently being validated
40 * @param array $params the additional name-value pairs given in the rule
41 */
42 public function validatePassword($attribute, $params)
43 {
44 if (!$this->hasErrors()) {
45 $user = $this->getUser();
46
47 if (!$user || !$user->validatePassword($this->password)) {
48 $this->addError($attribute, 'Incorrect username or password.');
49 }
50 }
51 }
52
53 /**
54 * Logs in a user using the provided username and password.
55 * @return boolean whether the user is logged in successfully
56 */
57 public function login()
58 {
59 if ($this->validate()) {
60 return Yii::$app->user->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0);
61 } else {
62 return false;
63 }
64 }
65
66 /**
67 * Finds user by [[username]]
68 *
69 * @return User|null
70 */
71 public function getUser()
72 {
73 if ($this->_user === false) {
74 $this->_user = User::findByUsername($this->username);
75 }
76
77 return $this->_user;
78 }
79 }
<?php
namespace app\models;
use Yii;
/**
* This is the model class for table "user".
*
* @property integer $id
* @property integer $pid
* @property string $username
* @property string $password
* @property integer $type
* @property integer $created_time
* @property integer $updated_time
* @property integer $status
* @property string $login_ip
* @property integer $login_time
* @property integer $login_count
* @property integer $update_password
*/
class User extends \yii\db\ActiveRecord implements \yii\web\IdentityInterface
{
public $authKey;
/**
* @inheritdoc
*/
public static function tableName()
{
return 'user';
}
/**
* @inheritdoc
*/
public function rules()
{
return [
[['pid', 'type', 'created_time', 'updated_time', 'status', 'login_time', 'login_count', 'update_password'], 'integer'],
[['username', 'password', 'created_time', 'updated_time', 'login_ip', 'login_time'], 'required'],
[['username', 'password'], 'string', 'max' => 70],
[['login_ip'], 'string', 'max' => 20]
];
}
/**
* @inheritdoc
*/
public function attributeLabels()
{
return [
'id' => 'ID',
'pid' => 'Pid',
'username' => 'Username',
'password' => 'Password',
'type' => 'Type',
'created_time' => 'Created Time',
'updated_time' => 'Updated Time',
'status' => 'Status',
'login_ip' => 'Login Ip',
'login_time' => 'Login Time',
'login_count' => 'Login Count',
'update_password' => 'Update Password',
];
}
/**
* @inheritdoc
*/
public static function findIdentity($id) {
return static::findOne($id);
}
/**
* @inheritdoc
*/
public static function findIdentityByAccessToken($token, $type = null) {
return null;
}
/**
* Finds user by username
*
* @param string $username
* @return static|null
*/
public static function findByUsername($username) {
$user = User::find()
->where(['username' => $username])
->asArray()
->one();
if ($user) {
return new static($user);
}
return null;
}
/**
* @inheritdoc
*/
public function getId() {
return $this->id;
}
/**
* @inheritdoc
*/
public function getAuthKey() {
return $this->authKey;
}
/**
* @inheritdoc
*/
public function validateAuthKey($authKey) {
return $this->authKey === $authKey;
}
/**
* Validates password
*
* @param string $password password to validate
* @return boolean if password provided is valid for current user
*/
public function validatePassword($password) {
return Yii::$app->getSecurity()->validatePassword($password, $this->password); #,返回true或false
}
#-------------------------------------辅助验证-----------------------------------------------------------
public function createhashpasswd(){
echo Yii::$app->getSecurity()->generatePasswordHash('123');
}
}
ok，这样就实现了哈希加密的用户登录了。
扫一扫
4742
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
