Yii2 用户登录

朴灿烈づ我的快乐病毒、 2022-10-02 01:47 160阅读 0赞

[2019独角兽企业重金招聘Python工程师标准>>> ][2019_Python_] ![hot3.png][]

## Yii2 用户登录，Yii2用户登录 ##

在Yii2的basic版本中默认是从一个数组验证用户名和密码，如何改为从数据表中查询验证呢？且数据库的密码要为哈希加密密码验证？

下面我们就一步一步解析Yii2的登录过程。

## 一. 创建user表模型 ##

表结构如下：

CREATE TABLE `user` (
      `id` int(11) NOT NULL AUTO_INCREMENT,
      `pid` int(11) NOT NULL DEFAULT '0' COMMENT '父id',
      `username` char(70) NOT NULL COMMENT '用户名',
      `password` char(70) NOT NULL COMMENT '密码',
      `type` tinyint(4) NOT NULL DEFAULT '4' COMMENT '类型(1:总店,2:门店,3:管理员)',
      `created_time` int(11) NOT NULL COMMENT '注册时间',
      `updated_time` int(11) NOT NULL COMMENT '修改时间',
      `status` tinyint(4) NOT NULL DEFAULT '1' COMMENT '封禁状态，0禁止1正常',
      `login_ip` char(20) NOT NULL COMMENT '登录ip',
      `login_time` int(11) NOT NULL COMMENT '上一次登录时间',
      `login_count` int(10) NOT NULL DEFAULT '0' COMMENT '登陆次数',
      `update_password` int(10) NOT NULL DEFAULT '0' COMMENT '修改密码次数',
      PRIMARY KEY (`id`),
      KEY `pid` (`pid`),
      KEY `username` (`username`),
      KEY `type` (`type`),
      KEY `status` (`status`)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='登录管理表';

使用Gii创建user模型

![1A0244508-0.png][]

将Yii2 basic之前user模型代码导入现在user中（先备份之前basic中的user模型）

1 namespace app\models;
      2 
      3 use Yii;
      4 
      5 /**
      6  * This is the model class for table "user".
      7  *
      8  * @property integer $id
      9  * @property integer $pid
     10  * @property string $username
     11  * @property string $password
     12  * @property integer $type
     13  * @property integer $created_time
     14  * @property integer $updated_time
     15  * @property integer $status
     16  * @property string $login_ip
     17  * @property integer $login_time
     18  * @property integer $login_count
     19  * @property integer $update_password
     20  */
     21 class User extends \yii\db\ActiveRecord  implements \yii\web\IdentityInterface 
     22 {   public $authKey;
     23    /*public $id;
     24     public $username;
     25     public $password;
     26     public $authKey;
     27     public $accessToken;
     28 
     29     private static $users = [
     30         '100' => [
     31             'id' => '100',
     32             'username' => 'admin',
     33             'password' => 'admin',
     34             'authKey' => 'test100key',
     35             'accessToken' => '100-token',
     36         ],
     37         '101' => [
     38             'id' => '101',
     39             'username' => 'demo',
     40             'password' => 'demo',
     41             'authKey' => 'test101key',
     42             'accessToken' => '101-token',
     43         ],
     44     ];
     45 */
     46 
     47     /**
     48      * @inheritdoc
     49      */
     50     public static function tableName()
     51     {
     52         return 'user';
     53     }
     54 
     55     /**
     56      * @inheritdoc
     57      */
     58     public function rules()
     59     {
     60         return [
     61             [['pid', 'type', 'created_time', 'updated_time', 'status', 'login_time', 'login_count', 'update_password'], 'integer'],
     62             [['username', 'password', 'created_time', 'updated_time', 'login_ip', 'login_time'], 'required'],
     63             [['username', 'password'], 'string', 'max' => 70],
     64             [['login_ip'], 'string', 'max' => 20]
     65         ];
     66     }
     67 
     68     /**
     69      * @inheritdoc
     70      */
     71     public function attributeLabels()
     72     {
     73         return [
     74             'id' => 'ID',
     75             'pid' => 'Pid',
     76             'username' => 'Username',
     77             'password' => 'Password',
     78             'type' => 'Type',
     79             'created_time' => 'Created Time',
     80             'updated_time' => 'Updated Time',
     81             'status' => 'Status',
     82             'login_ip' => 'Login Ip',
     83             'login_time' => 'Login Time',
     84             'login_count' => 'Login Count',
     85             'update_password' => 'Update Password',
     86         ];
     87     }
     88 
     89     /**
     90      * @inheritdoc
     91      */
     92     public static function findIdentity($id)
     93     {
     94         return static::findOne($id);
     95         //return isset(self::$users[$id]) ? new static(self::$users[$id]) : null;
     96     }
     97 
     98     /**
     99      * @inheritdoc
    100      */
    101     public static function findIdentityByAccessToken($token, $type = null)
    102     {
    103         return static::findOne(['access_token' => $token]);
    104         /*foreach (self::$users as $user) {
    105             if ($user['accessToken'] === $token) {
    106                 return new static($user);
    107             }
    108         }
    109 
    110         return null;*/
    111     }
    112 
    113     /**
    114      * Finds user by username
    115      *
    116      * @param  string      $username
    117      * @return static|null
    118      */
    119     public static function findByUsername($username)
    120     {
    121           $user = User::find()
    122             ->where(['username' => $username])
    123             ->asArray()
    124             ->one();
    125 
    126             if($user){
    127             return new static($user);
    128         }
    129 
    130         return null;
    131         /*foreach (self::$users as $user) {
    132             if (strcasecmp($user['username'], $username) === 0) {
    133                 return new static($user);
    134             }
    135         }
    136 
    137         return null;*/
    138     }
    139 
    140     /**
    141      * @inheritdoc
    142      */
    143     public function getId()
    144     {
    145         return $this->id;
    146     }
    147 
    148     /**
    149      * @inheritdoc
    150      */
    151     public function getAuthKey()
    152     {
    153         return $this->authKey;
    154     }
    155 
    156     /**
    157      * @inheritdoc
    158      */
    159     public function validateAuthKey($authKey)
    160     {
    161         return $this->authKey === $authKey;
    162     }
    163 
    164     /**
    165      * Validates password
    166      *
    167      * @param  string  $password password to validate
    168      * @return boolean if password provided is valid for current user
    169      */
    170     public function validatePassword($password)
    171     {
    172         return $this->password === $password;
    173     }
    174 }

之前的basic中User模型是继承了\\yii\\base\\Object，为什么要继承这个类，那是因为

1 #在\yii\base\Object中，有构造方法
     2  public function __construct($config = [])
     3     {
     4         if (!empty($config)) {
     5             Yii::configure($this, $config);
     6         }
     7         $this->init();
     8     }   
     9 #继续追踪Yii::configure($this, $config)代码如下 
    10 public static function configure($object, $properties)
    11     {
    12         foreach ($properties as $name => $value) {
    13             $object->$name = $value;
    14         }
    15 
    16         return $object;
    17     }
    18 #正是因为有这两个方法，所以在User.php中
    19 public static function findByUsername($username)
    20     {
    21         foreach (self::$users as $user) {
    22             if (strcasecmp($user['username'], $username) === 0) {
    23                 return new static($user);
    24             }
    25         }
    26 
    27         return null;
    28     }
    29 #将$user传递过来，通过static，返回一个User的实例。

当通过数据表查询时候没有必要再继承\\yii\\base\\Object，因为不必为类似原来类变量赋值了。这个时候需要User模型继承\\yii\\db\\ActiveRecord，因为要查询用。

findIdentity是根据传递的id返回对应的用户信息，getId返回用户id，getAuthKey和validateAuthKey是作用于登陆中的--记住我。这个authKey是唯一的，当再次登陆时，从cookie中获取authKey传递给validateAuthKey，验证通过，就登陆成功。

## 二. 模拟用户数据登录 ##

插入一条用户模拟数据

INSERT INTO `user` (`username`, `password`) VALUES ('admin', '123')

![1A024G04-1.png][]

控制器Controller

1     /**
     2      * 登录
     3      */
     4     public function actionLogin() {
     5          if (!\Yii::$app->user->isGuest) {
     6             return $this->goHome();
     7         }
     8 
     9         $model = new LoginForm(); 
    10         if ($model->load(Yii::$app->request->post()) && $model->login()) {
    11             
    12           
    13             $this->redirect(array('charisma/index'));
    14         } else {
    15             return $this->render('login', [
    16                         'model' => $model,
    17             ]);
    18         }
    19     }

veiws中的login.php

1 <div class="well col-md-5 center login-box">
     2                         <div class="alert alert-info">
     3                             请填写您的用户名和密码
     4                         </div>
     5                         
     6                         <?php $form = ActiveForm::begin([
     7                               'id' => 'login-form',
     8                         ]); ?>
     9 
    10                             <fieldset>
    11                                 <div class="input-group input-group-lg">
    12                                     <span class="input-group-addon"><i class="glyphicon glyphicon-user red"></i></span>
    13                                      <?php echo Html::input('type','LoginForm[username]', $model->username, ['class'=>'form-control','placeholder'=>'Username']); ?>
    14                                 </div>
    15                                 <div class="clearfix"></div><br>
    16                                 <div class="input-group input-group-lg">
    17                                     <span class="input-group-addon"><i class="glyphicon glyphicon-lock red"></i></span>
    18                                      <?php echo Html::input('password','LoginForm[password]', $model->password, ['class'=>'form-control','placeholder'=>'Password']); ?>
    19                                 </div>
    20                                 <div class="clearfix"></div>
    21                                
    22                                 <div class="clearfix"></div>
    23                                 <p class="center col-md-5"> 
    24                                     <input type="submit" class="btn btn-primary" value="Login"> 
    25                                 </p>
    26                             </fieldset>
    27                         <?php ActiveForm::end();?>
    28                         
    29                         <?php
    30                         if($model->errors){
    31                             echo '用户名或密码错误';
    32                             print_r($model->errors);
    33                         }
    34                         
    35 
    36                         
    37                         ?>
    38                         
    39                     </div>

![1A024MC-2.png][]

用户名admin， 密码123， 登录ok！

问题来了，我们使用的是明文保存的密码，这样很不安全，所以我们必须要把用户注册时的密码哈希加密后再保存到数据库。

## 三. Yii的密码加密 ##

YII2对密码加密生成的结果是不同的，即用相同的初始密码在不同时间得到的加密结果不同，所以我们不能用常用的方法去验证密码是否正确（将密码加密后与数据库中的密码相比较）。YII2有自己的加密以及密码验证流程。

加密

$hash = Yii::$app->getSecurity()->generatePasswordHash('123456');

验证

Yii::$app->getSecurity()->validatePassword('123456', $hash) ; #,返回true或false

我们先通过Yii的加密机制加密 “123” 获取哈希密码为： $2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy

修改模拟数据admin的密码：

UPDATE `user` SET `password`='$2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy' WHERE (`username`='admin')

## 四.密码验证过程 ##

在控制器中我们通过 实例化LoginForm，

Yii::$app->request->post()来获取post提交的值，通过$model->load()加载post数据

然后$model->login() 就是验证登录

$model = new LoginForm(); 
            if ($model->load(Yii::$app->request->post()) && $model->login()) { 
                $this->redirect(array('charisma/index'));
            }

我们跳转到app\\models\\LoginForm的login方法

public function login()
        { 
    
            if ($this->validate()) {
    
                return Yii::$app->user->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0);
            } else {
                return false;
            }
        }

login方法又是通过一个validate验证方法 继承vendor/yiisoft/yii2/base/Model.php

该验证方法描述是这样的：Performs the data validation. This method executes the validation rules applicable to the current \[\[scenario\]\]. The following criteria are used to determine whether a rule is currently applicable: - the rule must be associated with the attributes relevant to the current scenario; - the rules must be effective for the current scenario. This method will call \[\[beforeValidate()\]\] and \[\[afterValidate()\]\] before and after the actual validation, respectively. If \[\[beforeValidate()\]\] returns false, the validation will be cancelled and \[\[afterValidate()\]\] will not be called. Errors found during the validation can be retrieved via \[\[getErrors()\]\], \[\[getFirstErrors()\]\] and \[\[getFirstError()\]\].

我们打开model类的validate()

public function validate($attributeNames = null, $clearErrors = true)
        {
            if ($clearErrors) {
                $this->clearErrors();
            }
    
            if (!$this->beforeValidate()) {
                return false;
            }
    
            $scenarios = $this->scenarios();
            $scenario = $this->getScenario();
            if (!isset($scenarios[$scenario])) {
                throw new InvalidParamException("Unknown scenario: $scenario");
            }
    
            if ($attributeNames === null) {
                $attributeNames = $this->activeAttributes();
            }
    
            foreach ($this->getActiveValidators() as $validator) {
                $validator->validateAttributes($this, $attributeNames);
            }
            $this->afterValidate();
    
            return !$this->hasErrors();
        }

也就是说获取到场景且没有错误的话，将场景yii\\validators\\RequiredValidator Object的每一个属性实例化为对应Form规则（rules）实例

foreach ($this->getActiveValidators() as $validator) {
                $validator->validateAttributes($this, $attributeNames);
            }

现在找到LoginForm的验证规则

/**
         * @return array the validation rules.
         */
        public function rules()
        {
            return [
                // username and password are both required
                [['username', 'password'], 'required'],
                // rememberMe must be a boolean value
                ['rememberMe', 'boolean'],
                // password is validated by validatePassword()
                ['password', 'validatePassword'],
            ];
        }

其中username,password 必填， rememberMe为波尔类型， password通过ValidatePassword方法来验证

查看validatePassword方法

/**
         * Validates the password.
         * This method serves as the inline validation for password.
         *
         * @param string $attribute the attribute currently being validated
         * @param array $params the additional name-value pairs given in the rule
         */
        public function validatePassword($attribute, $params)
        {
            if (!$this->hasErrors()) {
                $user = $this->getUser();
    
                if (!$user || !$user->validatePassword($this->password)) {
                    $this->addError($attribute, 'Incorrect username or password.');
                }
            }
        }

首先$this->getUser()会判断在user表中是否有username=“admin”，如果存在就返回一个user的实例

public static function findByUsername($username) {
          $user = User::find()
                    ->where(['username' => $username])
                    ->asArray()
                    ->one();
            if ($user) {
                return new static($user);
            }
    
            return null;
    
        }

通过$user->validatePassword($this->password) 判断验证密码，这个是最关键的一步

因为之前通过$this->getUser 已经实例化了user表，所以validatePassword在User模型的原始代码是这样的

/**
         * Validates password
         *
         * @param  string  $password password to validate
         * @return boolean if password provided is valid for current user
         */
        public function validatePassword($password) {
    
            return $this->password === $password;
        }

获取用户输入的密码， 再和数据库中的密码做对比，如果密码相同就通过验证。

现在我们已经把密码123改为哈希密码：$2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy

所以要通过Yii2 自带的验证 Yii::$app->getSecurity()->validatePassword('123456', $hash) ; 进行验证

所以validatePassword方法的代码应该修改如下：

完整的LoginForm模型和User模型代码如下：

1 <?php
     2 
     3 namespace app\models;
     4 
     5 use Yii;
     6 use yii\base\Model;
     7 
     8 /**
     9  * LoginForm is the model behind the login form.
    10  */
    11 class LoginForm extends Model
    12 {
    13     public $username;
    14     public $password;
    15     public $rememberMe = true;
    16 
    17     private $_user = false;
    18 
    19 
    20     /**
    21      * @return array the validation rules.
    22      */
    23     public function rules()
    24     {
    25         return [
    26             // username and password are both required
    27             [['username', 'password'], 'required'],
    28             // rememberMe must be a boolean value
    29             ['rememberMe', 'boolean'],
    30             // password is validated by validatePassword()
    31             ['password', 'validatePassword'],
    32         ];
    33     }
    34 
    35     /**
    36      * Validates the password.
    37      * This method serves as the inline validation for password.
    38      *
    39      * @param string $attribute the attribute currently being validated
    40      * @param array $params the additional name-value pairs given in the rule
    41      */
    42     public function validatePassword($attribute, $params)
    43     {
    44         if (!$this->hasErrors()) {
    45             $user = $this->getUser();
    46 
    47             if (!$user || !$user->validatePassword($this->password)) {
    48                 $this->addError($attribute, 'Incorrect username or password.');
    49             }
    50         }
    51     }
    52 
    53     /**
    54      * Logs in a user using the provided username and password.
    55      * @return boolean whether the user is logged in successfully
    56      */
    57     public function login()
    58     { 
    59         if ($this->validate()) {
    60             return Yii::$app->user->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0);
    61         } else {
    62             return false;
    63         }
    64     }
    65 
    66     /**
    67      * Finds user by [[username]]
    68      *
    69      * @return User|null
    70      */
    71     public function getUser()
    72     {
    73         if ($this->_user === false) {
    74             $this->_user = User::findByUsername($this->username);
    75         }
    76 
    77         return $this->_user;
    78     }
    79 }

<?php
    
    namespace app\models;
    
    use Yii;
    
    /**
     * This is the model class for table "user".
     *
     * @property integer $id
     * @property integer $pid
     * @property string $username
     * @property string $password
     * @property integer $type
     * @property integer $created_time
     * @property integer $updated_time
     * @property integer $status
     * @property string $login_ip
     * @property integer $login_time
     * @property integer $login_count
     * @property integer $update_password
     */
    class User extends \yii\db\ActiveRecord  implements \yii\web\IdentityInterface 
    {
        public $authKey;
        /**
         * @inheritdoc
         */
        public static function tableName()
        {
            return 'user';
        }
    
        /**
         * @inheritdoc
         */
        public function rules()
        {
            return [
                [['pid', 'type', 'created_time', 'updated_time', 'status', 'login_time', 'login_count', 'update_password'], 'integer'],
                [['username', 'password', 'created_time', 'updated_time', 'login_ip', 'login_time'], 'required'],
                [['username', 'password'], 'string', 'max' => 70],
                [['login_ip'], 'string', 'max' => 20]
            ];
        }
    
        /**
         * @inheritdoc
         */
        public function attributeLabels()
        {
            return [
                'id' => 'ID',
                'pid' => 'Pid',
                'username' => 'Username',
                'password' => 'Password',
                'type' => 'Type',
                'created_time' => 'Created Time',
                'updated_time' => 'Updated Time',
                'status' => 'Status',
                'login_ip' => 'Login Ip',
                'login_time' => 'Login Time',
                'login_count' => 'Login Count',
                'update_password' => 'Update Password',
            ];
        }
        
         /**
         * @inheritdoc
         */
        public static function findIdentity($id) {
            return static::findOne($id);
        }
    
        /**
         * @inheritdoc
         */
        public static function findIdentityByAccessToken($token, $type = null) {
            return null;
        }
    
        /**
         * Finds user by username
         *
         * @param  string      $username
         * @return static|null
         */
        public static function findByUsername($username) {
            $user = User::find()
                    ->where(['username' => $username])
                    ->asArray()
                    ->one();
            if ($user) {
                return new static($user);
            }
    
            return null;
        }
    
        /**
         * @inheritdoc
         */
        public function getId() {
            return $this->id;
        }
    
        /**
         * @inheritdoc
         */
        public function getAuthKey() {
            return $this->authKey;
        }
    
        /**
         * @inheritdoc
         */
        public function validateAuthKey($authKey) {
            return $this->authKey === $authKey;
        }
    
        /**
         * Validates password
         *
         * @param  string  $password password to validate
         * @return boolean if password provided is valid for current user
         */
        public function validatePassword($password) {
    
            return  Yii::$app->getSecurity()->validatePassword($password, $this->password);   #,返回true或false
        }
    
        
        
        #-------------------------------------辅助验证-----------------------------------------------------------
        
        
        public function createhashpasswd(){
         echo   Yii::$app->getSecurity()->generatePasswordHash('123');
        }
    
    }

ok，这样就实现了哈希加密的用户登录了。

转载于:https://my.oschina.net/youcaihua/blog/691136

[2019_Python_]: https://my.oschina.net/u/2663968/blog/3061697
[hot3.png]: /images/20220113/a8283dc33ac84930b1536945cd411251.png
[1A0244508-0.png]: http://www.bkjia.com/uploads/allimg/150723/1A0244508-0.png
[1A024G04-1.png]: http://www.bkjia.com/uploads/allimg/150723/1A024G04-1.png
[1A024MC-2.png]: http://www.bkjia.com/uploads/allimg/150723/1A024MC-2.png