Yii2 用户登录，Yii2用户登录
程序员文章站
2024-02-08 08:15:04
...
Yii2 用户登录，Yii2用户登录
在Yii2的basic版本中默认是从一个数组验证用户名和密码，如何改为从数据表中查询验证呢？且数据库的密码要为哈希加密密码验证？
下面我们就一步一步解析Yii2的登录过程。
一. 创建user表模型
表结构如下：
CREATE TABLE `user` ( `id` int(11) NOT NULL AUTO_INCREMENT, `pid` int(11) NOT NULL DEFAULT '0' COMMENT '父id', `username` char(70) NOT NULL COMMENT '用户名', `password` char(70) NOT NULL COMMENT '密码', `type` tinyint(4) NOT NULL DEFAULT '4' COMMENT '类型(1:总店,2:门店,3:管理员)', `created_time` int(11) NOT NULL COMMENT '注册时间', `updated_time` int(11) NOT NULL COMMENT '修改时间', `status` tinyint(4) NOT NULL DEFAULT '1' COMMENT '封禁状态，0禁止1正常', `login_ip` char(20) NOT NULL COMMENT '登录ip', `login_time` int(11) NOT NULL COMMENT '上一次登录时间', `login_count` int(10) NOT NULL DEFAULT '0' COMMENT '登陆次数', `update_password` int(10) NOT NULL DEFAULT '0' COMMENT '修改密码次数', PRIMARY KEY (`id`), KEY `pid` (`pid`), KEY `username` (`username`), KEY `type` (`type`), KEY `status` (`status`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='登录管理表';
使用Gii创建user模型
将Yii2 basic之前user模型代码导入现在user中（先备份之前basic中的user模型）
1 namespace app\models; 2 3 use Yii; 4 5 /** 6 * This is the model class for table "user". 7 * 8 * @property integer $id 9 * @property integer $pid 10 * @property string $username 11 * @property string $password 12 * @property integer $type 13 * @property integer $created_time 14 * @property integer $updated_time 15 * @property integer $status 16 * @property string $login_ip 17 * @property integer $login_time 18 * @property integer $login_count 19 * @property integer $update_password 20 */ 21 class User extends \yii\db\ActiveRecord implements \yii\web\IdentityInterface 22 { public $authKey; 23 /*public $id; 24 public $username; 25 public $password; 26 public $authKey; 27 public $accessToken; 28 29 private static $users = [ 30 '100' => [ 31 'id' => '100', 32 'username' => 'admin', 33 'password' => 'admin', 34 'authKey' => 'test100key', 35 'accessToken' => '100-token', 36 ], 37 '101' => [ 38 'id' => '101', 39 'username' => 'demo', 40 'password' => 'demo', 41 'authKey' => 'test101key', 42 'accessToken' => '101-token', 43 ], 44 ]; 45 */ 46 47 /** 48 * @inheritdoc 49 */ 50 public static function tableName() 51 { 52 return 'user'; 53 } 54 55 /** 56 * @inheritdoc 57 */ 58 public function rules() 59 { 60 return [ 61 [['pid', 'type', 'created_time', 'updated_time', 'status', 'login_time', 'login_count', 'update_password'], 'integer'], 62 [['username', 'password', 'created_time', 'updated_time', 'login_ip', 'login_time'], 'required'], 63 [['username', 'password'], 'string', 'max' => 70], 64 [['login_ip'], 'string', 'max' => 20] 65 ]; 66 } 67 68 /** 69 * @inheritdoc 70 */ 71 public function attributeLabels() 72 { 73 return [ 74 'id' => 'ID', 75 'pid' => 'Pid', 76 'username' => 'Username', 77 'password' => 'Password', 78 'type' => 'Type', 79 'created_time' => 'Created Time', 80 'updated_time' => 'Updated Time', 81 'status' => 'Status', 82 'login_ip' => 'Login Ip', 83 'login_time' => 'Login Time', 84 'login_count' => 'Login Count', 85 'update_password' => 'Update Password', 86 ]; 87 } 88 89 /** 90 * @inheritdoc 91 */ 92 public static function findIdentity($id) 93 { 94 return static::findOne($id); 95 //return isset(self::$users[$id]) ? new static(self::$users[$id]) : null; 96 } 97 98 /** 99 * @inheritdoc 100 */ 101 public static function findIdentityByAccessToken($token, $type = null) 102 { 103 return static::findOne(['access_token' => $token]); 104 /*foreach (self::$users as $user) { 105 if ($user['accessToken'] === $token) { 106 return new static($user); 107 } 108 } 109 110 return null;*/ 111 } 112 113 /** 114 * Finds user by username 115 * 116 * @param string $username 117 * @return static|null 118 */ 119 public static function findByUsername($username) 120 { 121 $user = User::find() 122 ->where(['username' => $username]) 123 ->asArray() 124 ->one(); 125 126 if($user){ 127 return new static($user); 128 } 129 130 return null; 131 /*foreach (self::$users as $user) { 132 if (strcasecmp($user['username'], $username) === 0) { 133 return new static($user); 134 } 135 } 136 137 return null;*/ 138 } 139 140 /** 141 * @inheritdoc 142 */ 143 public function getId() 144 { 145 return $this->id; 146 } 147 148 /** 149 * @inheritdoc 150 */ 151 public function getAuthKey() 152 { 153 return $this->authKey; 154 } 155 156 /** 157 * @inheritdoc 158 */ 159 public function validateAuthKey($authKey) 160 { 161 return $this->authKey === $authKey; 162 } 163 164 /** 165 * Validates password 166 * 167 * @param string $password password to validate 168 * @return boolean if password provided is valid for current user 169 */ 170 public function validatePassword($password) 171 { 172 return $this->password === $password; 173 } 174 }
之前的basic中User模型是继承了\yii\base\Object，为什么要继承这个类，那是因为
1 #在\yii\base\Object中，有构造方法 2 public function __construct($config = []) 3 { 4 if (!empty($config)) { 5 Yii::configure($this, $config); 6 } 7 $this->init(); 8 } 9 #继续追踪Yii::configure($this, $config)代码如下 10 public static function configure($object, $properties) 11 { 12 foreach ($properties as $name => $value) { 13 $object->$name = $value; 14 } 15 16 return $object; 17 } 18 #正是因为有这两个方法，所以在User.php中 19 public static function findByUsername($username) 20 { 21 foreach (self::$users as $user) { 22 if (strcasecmp($user['username'], $username) === 0) { 23 return new static($user); 24 } 25 } 26 27 return null; 28 } 29 #将$user传递过来，通过static，返回一个User的实例。
当通过数据表查询时候没有必要再继承\yii\base\Object，因为不必为类似原来类变量赋值了。这个时候需要User模型继承\yii\db\ActiveRecord，因为要查询用。
findIdentity是根据传递的id返回对应的用户信息，getId返回用户id，getAuthKey和validateAuthKey是作用于登陆中的--记住我。这个authKey是唯一的，当再次登陆时，从cookie中获取authKey传递给validateAuthKey，验证通过，就登陆成功。
二. 模拟用户数据登录
插入一条用户模拟数据
INSERT INTO `user` (`username`, `password`) VALUES ('admin', '123')
控制器Controller
1 /** 2 * 登录 3 */ 4 public function actionLogin() { 5 if (!\Yii::$app->user->isGuest) { 6 return $this->goHome(); 7 } 8 9 $model = new LoginForm(); 10 if ($model->load(Yii::$app->request->post()) && $model->login()) { 11 12 13 $this->redirect(array('charisma/index')); 14 } else { 15 return $this->render('login', [ 16 'model' => $model, 17 ]); 18 } 19 }
veiws中的login.php
1class="well col-md-5 center login-box"> 2class="alert alert-info"> 3 请填写您的用户名和密码 45 6 $form = ActiveForm::begin([ 7 'id' => 'login-form', 8 ]); ?> 9 10 27 end();?> 28 29 php 30 if($model->errors){ 31 echo '用户名或密码错误'; 32 print_r($model->errors); 33 } 34 35 36 37 ?> 38 39
用户名admin， 密码123， 登录ok！
问题来了，我们使用的是明文保存的密码，这样很不安全，所以我们必须要把用户注册时的密码哈希加密后再保存到数据库。
三. Yii的密码加密
YII2对密码加密生成的结果是不同的，即用相同的初始密码在不同时间得到的加密结果不同，所以我们不能用常用的方法去验证密码是否正确（将密码加密后与数据库中的密码相比较）。YII2有自己的加密以及密码验证流程。
加密
$hash = Yii::$app->getSecurity()->generatePasswordHash('123456');
验证
Yii::$app->getSecurity()->validatePassword('123456', $hash) ; #,返回true或false
我们先通过Yii的加密机制加密 “123” 获取哈希密码为： $2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy
修改模拟数据admin的密码：
UPDATE `user` SET `password`='$2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy' WHERE (`username`='admin')
四.密码验证过程
在控制器中我们通过 实例化LoginForm，
Yii::$app->request->post()来获取post提交的值，通过$model->load()加载post数据
然后$model->login() 就是验证登录
$model = new LoginForm(); if ($model->load(Yii::$app->request->post()) && $model->login()) { $this->redirect(array('charisma/index')); }
我们跳转到app\models\LoginForm的login方法
public function login() { if ($this->validate()) { return Yii::$app->user->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0); } else { return false; } }
login方法又是通过一个validate验证方法 继承vendor/yiisoft/yii2/base/Model.php
该验证方法描述是这样的：Performs the data validation. This method executes the validation rules applicable to the current [[scenario]]. The following criteria are used to determine whether a rule is currently applicable: - the rule must be associated with the attributes relevant to the current scenario; - the rules must be effective for the current scenario. This method will call [[beforeValidate()]] and [[afterValidate()]] before and after the actual validation, respectively. If [[beforeValidate()]] returns false, the validation will be cancelled and [[afterValidate()]] will not be called. Errors found during the validation can be retrieved via [[getErrors()]], [[getFirstErrors()]] and [[getFirstError()]].
我们打开model类的validate()
public function validate($attributeNames = null, $clearErrors = true) { if ($clearErrors) { $this->clearErrors(); } if (!$this->beforeValidate()) { return false; } $scenarios = $this->scenarios(); $scenario = $this->getScenario(); if (!isset($scenarios[$scenario])) { throw new InvalidParamException("Unknown scenario: $scenario"); } if ($attributeNames === null) { $attributeNames = $this->activeAttributes(); } foreach ($this->getActiveValidators() as $validator) { $validator->validateAttributes($this, $attributeNames); } $this->afterValidate(); return !$this->hasErrors(); }
也就是说获取到场景且没有错误的话，将场景yii\validators\RequiredValidator Object的每一个属性实例化为对应Form规则（rules）实例
foreach ($this->getActiveValidators() as $validator) { $validator->validateAttributes($this, $attributeNames); }
现在找到LoginForm的验证规则
/** * @return array the validation rules. */ public function rules() { return [ // username and password are both required [['username', 'password'], 'required'], // rememberMe must be a boolean value ['rememberMe', 'boolean'], // password is validated by validatePassword() ['password', 'validatePassword'], ]; }
其中username,password 必填， rememberMe为波尔类型， password通过ValidatePassword方法来验证
查看validatePassword方法
/** * Validates the password. * This method serves as the inline validation for password. * * @param string $attribute the attribute currently being validated * @param array $params the additional name-value pairs given in the rule */ public function validatePassword($attribute, $params) { if (!$this->hasErrors()) { $user = $this->getUser(); if (!$user || !$user->validatePassword($this->password)) { $this->addError($attribute, 'Incorrect username or password.'); } } }
首先$this->getUser()会判断在user表中是否有username=“admin”，如果存在就返回一个user的实例
public static function findByUsername($username) { $user = User::find() ->where(['username' => $username]) ->asArray() ->one(); if ($user) { return new static($user); } return null; }
通过$user->validatePassword($this->password) 判断验证密码，这个是最关键的一步
因为之前通过$this->getUser 已经实例化了user表，所以validatePassword在User模型的原始代码是这样的
/** * Validates password * * @param string $password password to validate * @return boolean if password provided is valid for current user */ public function validatePassword($password) { return $this->password === $password; }
获取用户输入的密码， 再和数据库中的密码做对比，如果密码相同就通过验证。
现在我们已经把密码123改为哈希密码：$2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy
所以要通过Yii2 自带的验证 Yii::$app->getSecurity()->validatePassword('123456', $hash) ; 进行验证
所以validatePassword方法的代码应该修改如下：
/** * Validates password * * @param string $password password to validate * @return boolean if password provided is valid for current user */ public function validatePassword($password) { return Yii::$app->getSecurity()->validatePassword($password, $this->password); }
完整的LoginForm模型和User模型代码如下：
1 php 2 3 namespace app\models; 4 5 use Yii; 6 use yii\base\Model; 7 8 /** 9 * LoginForm is the model behind the login form. 10 */ 11 class LoginForm extends Model 12 { 13 public $username; 14 public $password; 15 public $rememberMe = true; 16 17 private $_user = false; 18 19 20 /** 21 * @return array the validation rules. 22 */ 23 public function rules() 24 { 25 return [ 26 // username and password are both required 27 [['username', 'password'], 'required'], 28 // rememberMe must be a boolean value 29 ['rememberMe', 'boolean'], 30 // password is validated by validatePassword() 31 ['password', 'validatePassword'], 32 ]; 33 } 34 35 /** 36 * Validates the password. 37 * This method serves as the inline validation for password. 38 * 39 * @param string $attribute the attribute currently being validated 40 * @param array $params the additional name-value pairs given in the rule 41 */ 42 public function validatePassword($attribute, $params) 43 { 44 if (!$this->hasErrors()) { 45 $user = $this->getUser(); 46 47 if (!$user || !$user->validatePassword($this->password)) { 48 $this->addError($attribute, 'Incorrect username or password.'); 49 } 50 } 51 } 52 53 /** 54 * Logs in a user using the provided username and password. 55 * @return boolean whether the user is logged in successfully 56 */ 57 public function login() 58 { 59 if ($this->validate()) { 60 return Yii::$app->user->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0); 61 } else { 62 return false; 63 } 64 } 65 66 /** 67 * Finds user by [[username]] 68 * 69 * @return User|null 70 */ 71 public function getUser() 72 { 73 if ($this->_user === false) { 74 $this->_user = User::findByUsername($this->username); 75 } 76 77 return $this->_user; 78 } 79 }
php namespace app\models; use Yii; /** * This is the model class for table "user". * * @property integer $id * @property integer $pid * @property string $username * @property string $password * @property integer $type * @property integer $created_time * @property integer $updated_time * @property integer $status * @property string $login_ip * @property integer $login_time * @property integer $login_count * @property integer $update_password */ class User extends \yii\db\ActiveRecord implements \yii\web\IdentityInterface { public $authKey; /** * @inheritdoc */ public static function tableName() { return 'user'; } /** * @inheritdoc */ public function rules() { return [ [['pid', 'type', 'created_time', 'updated_time', 'status', 'login_time', 'login_count', 'update_password'], 'integer'], [['username', 'password', 'created_time', 'updated_time', 'login_ip', 'login_time'], 'required'], [['username', 'password'], 'string', 'max' => 70], [['login_ip'], 'string', 'max' => 20] ]; } /** * @inheritdoc */ public function attributeLabels() { return [ 'id' => 'ID', 'pid' => 'Pid', 'username' => 'Username', 'password' => 'Password', 'type' => 'Type', 'created_time' => 'Created Time', 'updated_time' => 'Updated Time', 'status' => 'Status', 'login_ip' => 'Login Ip', 'login_time' => 'Login Time', 'login_count' => 'Login Count', 'update_password' => 'Update Password', ]; } /** * @inheritdoc */ public static function findIdentity($id) { return static::findOne($id); } /** * @inheritdoc */ public static function findIdentityByAccessToken($token, $type = null) { return null; } /** * Finds user by username * * @param string $username * @return static|null */ public static function findByUsername($username) { $user = User::find() ->where(['username' => $username]) ->asArray() ->one(); if ($user) { return new static($user); } return null; } /** * @inheritdoc */ public function getId() { return $this->id; } /** * @inheritdoc */ public function getAuthKey() { return $this->authKey; } /** * @inheritdoc */ public function validateAuthKey($authKey) { return $this->authKey === $authKey; } /** * Validates password * * @param string $password password to validate * @return boolean if password provided is valid for current user */ public function validatePassword($password) { return Yii::$app->getSecurity()->validatePassword($password, $this->password); #,返回true或false } #-------------------------------------辅助验证----------------------------------------------------------- public function createhashpasswd(){ echo Yii::$app->getSecurity()->generatePasswordHash('123'); } }
ok，这样就实现了哈希加密的用户登录了。
下一篇： oracle SQL分页代码