UnionOfRAD/lithium — Issue #185: Incompatibility in documentation on authorization
Author: rpkamp
Created: 2011-11-02 22:50:54+00:00
State: open

The page [Creating a user in M, V, C] (http://lithify.me/docs/manual/auth/simple-auth-user.wiki) describes how to add a filter to the user model so it saves the user's password using \lithium\security\Password::hash(). This is fine, but then [Simple Authentication] (http://lithify.me/docs/manual/auth/simple-authentication.wiki) continues by using the \lithium\security\auth\adapter\Form, which uses String::hash() (i.e., sha1) to hash passwords.

Thus, if one was to follow the procedure in order, one would end up with a system that does not work because of the different hashing functions.

Either both should use String::hash(), or [Simple Authentication] (http://lithify.me/docs/manual/auth/simple-authentication.wiki) should describe how to use \lithium\security\Password::check().

```php
_model;
$query = $this->_query;
$conditions = $this->_scope + $this->_filters(array_map('strval', $credentials->data));

// do not include the password in the query ...
unset($conditions['password']);
$user = $model::$query(compact('conditions'));

// ... instead verify the password using the Password class
if (Password::check($credentials->data['password'], $user->password))
return $user->data();
return false;
}

}

?>
```