Behavior only when Column changed?

Question

Behavior only when Column changed?

Hanmac Jun '13

Created Jun '13	Last Reply Jun '13	Replies 2	Views 684	Votes 1

Hanmac 608

Jun '13

hi i our project we use an Behavior that automatic uses md5 on the password column before the Model is saved ('beforeSave')

the problem is that if something else is changed beside the password, the Behavior does still trigger and does call md5 on the already hashed Password.

so is there an nice way to get only called when an specific column has changed?

1

Phalcon · Answer 1 · 2013-06-26T08:04:16-07:00

You can better use "beforeCreate" to hash the password, this is only triggered when the model is being created also note that md5 is not recommended as hashing algorithm for passwords, it's recommended using blowfish: https://docs.phalcon.io/en/latest/reference/security.html#password-hashing

Hanmac · Answer 2 · 2013-06-26T08:41:13-07:00

hm okay but what is if i also want that when i use $model->password = "real one" its automatically gets changed after save? Or i use ->save($this->getPost()) ?

Phalcon · Answer 3 · 2013-06-26T09:00:27-07:00

Check if the password in the model is a legacy password before hash it:

<?php

class Users extends Phalcon\Mvc\Model
{

    public $id;

    public $email;

    public $password;   

    public function beforeSave()
    {
        $security = $this->getDI()->getSecurity();
        if (!$security->isLegacyHash($this->password)) {
            $this->password = $security->hash($this->password);
        }
    }
}

Note that $user ->save($this->request->getPost()) without a white list could lead to mass assignment attacks changing values that aren't allowed to be changed such like profiles or usernames.