danielbcorreia/CakePHP-OAuth2-Server-Plugin — comment on commit db304515aa266f548f8efbed4333d0d53b98d887
File: Lib/OAuth2Lib.php line 232
By csrui:

Shouldn't this validate also against the current client_id?

This can authenticate anyone with and account that might not have created an Oauth client (btw, that table needs a user_id)

I've done something like:

public function check_user_credentials($client_id, $username, $password) {

// use CakePHP Auth Component to validate user credentials
$Auth = Configure::read('OAuth2Server.Auth.className');
$data[Configure::read('OAuth2Server.Auth.userModel')] = array(
Configure::read('OAuth2Server.Auth.fields.username') => $username,
Configure::read('OAuth2Server.Auth.fields.password') => $password
);
if ($Auth == 'Auth') { // only pre-hash passwords for original Auth component
$data = $this->controller->$Auth->hashPasswords($data);
}

$user = $this->controller->$Auth->identify($data);

// Checks if user exists
if (empty($user)) return false;

// Checks if user has a client configured
$this->loadModel('OAuth2Server.OAuth2ServerClient');
$conditions = array(
'user_id' => $user['id'],
'id' => $client_id,
'active' => 1
);

return (boolean) $this->OAuth2ServerClient->find('first', compact('conditions'));

}