Login

07-18-2009, 12:08 PM

[eluser]meteor[/eluser]
Just wrote a small class for auth purposes ...
It actually does two things:
1. encrypts password with sha1 or md5 hashing function and adds salt component in turn writing all that to the database
2. it authenticates user with data fetched from database ...

There is no data validation. It assumes that it has already been done and input is clean ...
It does not write anything to the database itself ... al this is delegated to your model object.
Both authenticate and register funcs get model object as their second argument.
This class is supposed to be instantiated in your controller and after prior checking of all your input data(there is no need to instantiate it if input data is dirty anyway).

It assumes, you have at least one model which coresponds to your database table
the table itself should have user,password(40 or 32),salt(9) and email(optional) fields

This is just simple example, written and tested in my spare time (today) ... and as such should be treated ...
I hope you(david) find it useful Wink

))

I'm attaching a few tests below the class ... regards

///////////////////////////////////////////////////////////////// Myauth.php

Code:

&lt;?php // if ( ! defined('BASEPATH')) exit('No direct script access allowed');

  class MyAuth{

    var $config = null;

    var $defaults = array(

      // we use sha1 for creating hashes

      'hash' => 'sha1',

      // salt_lenght should be 9 characters(ASCII assumed)

      'salt_length' => 9,

    ); 

    function __construct($config = array()){

     // use md5, but nothing else, if you does not like sha1 ...

      if(isset($config['hash']) and !in_array($config['hash'],array('sha1','md5'))){ throw new Exception('Hash type not supproted'); }

      $this->config = array_merge($this -> defaults,$config);

    }

    // this function just gets CLEAN data, creates hashed, salted password

    // and delegates writing data to the user_model

    // $data should look like this: 

    // $data = array('user' => 'my_user', 'password' => 'her_password','email' => '[email protected]');

    // $user_model is an instance of user_model

    function register($data,$user_model){

      $this->_salt($data['password']);

      $data['password'] = $this->salted_password; 

      $data['salt'] = $this->salt;

      return $user_model -> put_user($data); 

    }

    // this is an authentication function

    // it gets CLEAN data in the form of: array('user' => 'my_user', 'password' => 'her_password');  

    // and compares it with data fetched from database

    // the second argment to this func is a model object

    // (say, user) which is responsible for fetching data from db 

    function authenticate($data,$user_model){

      $db_data = $user_model -> get_user($data['user']);

      if(empty($db_data)){ return false; }   

      $user_obj = $db_data[0];

      $e_password = $user_obj -> password;  

      $this -> _salt($data['password'],$user_obj -> salt);

      return $this -> salted_password == $user_obj ->  password  ? true : false;     

    }

    // this should be made private !!!

    // it does not return anything ...

    // salted password is stored in $this -> salted_password;

    // salt used to reinforce password is stored in $this -> salt property  

    function _salt($password,$e_salt = null){

      $salt = is_null($e_salt) ? substr(uniqid(rand(),true),0,$this->config['salt_length']) : $e_salt;

      $this -> salted_password = $this -> config['hash'] == 'sha1' ? sha1($salt.$password) : md5($salt.$password);

      $this -> salt =  $salt;

    }

  }

?&gt;