CPasswordHelper::verifyPassword() how does it work?

Question

Yii

It's not clear how it works, maybe I'm doing something wrong
UserIdentity.php

private $_id;

public function authenticate(){

 $record = Users::model()->findByAttributes(array('login' => $this->username));

   if($record === null){
       $this->errorCode = self::ERROR_USERNAME_INVALID;
   }else if(CPasswordHelper::verifyPassword($this->password, $record->password)){
        $this->_id = $record->id;
  $this->errorCode = self::ERROR_NONE;

   }else{
  $this->errorCode = self::ERROR_PASSWORD_INVALID;
   }
   return !$this->errorCode;
}

Users.php

public function authenticate(){
    
   $identity = new UserIdentity($this->login, $this->password);

     if($identity->authenticate()){
   Yii::app()->user->login($identity,3600*24*30);
   return true;
     }else{
  $this->addError('password',"Неправильный логин или пароль.");
  return false;
    }
}

Authorization does not work, I’ve been sitting for 2 days and I can’t understand what I’m doing wrong, please help me figure it out.

Answer 1

Users.php

public function hashPassword($password){
     return CPasswordHelper::hashPassword($password);
}

public function validatePassword($password){
    return CPasswordHelper::verifyPassword($password,$this->password);
}

UserIdentity.php

public function authenticate(){

    $user = Users::model()->findByAttributes(array('login' => $this->username));

    if($user === null){
      $this->errorCode = self::ERROR_USERNAME_INVALID;
    }else if(!$user->validatePassword($this->password)){
      $this->errorCode = self::ERROR_PASSWORD_INVALID;
    }else{
      $this->_id = $user->id;
      $this->setState('login', $user->login);
      $this->errorCode = self::ERROR_NONE;
    }
    return $this->errorCode == self::ERROR_NONE;
  }

Answer 2

www.yiiframework.com/doc/api/1.1/CPasswordHelper#v...
that's how shitty it works. It simply generates a hash of the password and compares it. Not the most secure way.
The reasons for which authorization may not pass are - $this->password contains something incorrect, or you are passing an already hashed password, or an unhashed password in the user model, etc.

Answer 3

Good afternoon.
Have you resolved this issue? Faced this problem. I'm also sitting for the 2nd day)

Answer 4

des1roer.blogspot.ru/2015/02/yii.html
only there without salt

Answer 5

Also struggled with the problem. And the problem turned out to be simple: the database did not have enough length for the password field.