password decode in controller

Question

I use it to encode my password:

 $entity->setSalt(md5(time()));
 $encoder = new MessageDigestPasswordEncoder('sha1');
 $password = $encoder->encodePassword($editForm->get('password')->getData(), $entity->getSalt());
 $entity->setPassword($password);

But how could relizar step opposite? that is, how could I get the unencrypted password? if i use this

$entity->getPassword()

shows me this:

xOGjEeMdi4nwanOustbbJlDkug8=

Thank you very much for the reply. I am trying to create a form where users enter the old password and verify that it is true. in the form I have this:

            ->add('antigua', 'password', array('property_path' => false))
        ->add('password', 'repeated', array('first_name' => 'Nueva contraseña','second_name' => 'Repite contraseña','type' => 'password'));

and when I go to edit a user in the crud I have this: in update action :

public function updateAction($id)
    {
        $em = $this->getDoctrine()->getEntityManager();

        $entity = $em->getRepository('miomioBundle:Empleado')->find($id);

        if (!$entity) {
            throw $this->createNotFoundException('Unable to find Empleado entity.');
        }

        $editForm   = $this->createForm(new EmpleadoType(), $entity);
        $deleteForm = $this->createDeleteForm($id);

        $request = $this->getRequest();
        **$entity->getPassword() is blank why?**
        $editForm->bindRequest($request);

        if ($editForm->isValid()){
            $em->persist($entity);
            $em->flush();
        }
            return $this->redirect($this->generateUrl('empleado_edit', array('id' => $id)));

        return array(
            'entity'      => $entity,
            'edit_form'   => $editForm->createView(),
            'delete_form' => $deleteForm->createView(),
        );
    }

the problem is I can not get the encoded password is blank. (in db is correct) thanks

SHA1 is a one-way hash. You can calculate the 40 byte hash of a 3GB movie and there's obviously no way to get the original movie back. Now, for most usages you don't need the original password at all—you only need to verify whether the user knows it! — Álvaro González
– Álvaro González, Commented Dec 28, 2015 at 12:53

Genar · Accepted Answer · 2015-12-28 12:33:42Z

4

You should encrypt the same way the old password was, the password entered by user. The result encrypted password should be the same.

$encoder = new MessageDigestPasswordEncoder('sha1');
$password = $encoder->encodePassword($editForm->get('antigua')->getData(), $entity->getSalt());

Now you can compare the old encrypted password with the new user entered one...

edited Dec 28, 2015 at 12:33

answered Jul 11, 2013 at 16:45

Genar

4333 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sybio · Accepted Answer · 2012-10-27 15:48:39Z

There is no possibility to decrypt password encoded in sha1 or md5, these crypt methods were created to be impossible to be decrypt !

Custom encoder:

The only way is to create your own custom encoder using a homemade method to encrypt (and so to decrypt) your passwords, here an example: http://blogsh.de/2011/09/29/create-a-custom-password-encoder-for-symfony/

You are not forced to use the $salt inside encodePassword(), and you can replace for example each letter by a specific number so that you can retrieve the password by doing the opposite, you can also cut the salt and add part inside the password, etc...

Plaintext, not recommended:

Or less recommended, not encrypt your passwords and let them plaintext:

# app/config/security.yml
security:
    encoders:
        Symfony\Component\Security\Core\User\User: plaintext

Collectives™ on Stack Overflow

password decode in controller

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related