Symfony2 $user->setPassword() updates password as plain text [DataFixtures + FOSUserBundle]

Question

I'm trying to pre-populate a database with some User objects, but when I call $user->setPassword('some-password'); and then save the user object, the string 'some-password' is stored directly in the database, instead of the hashed+salted password.

My DataFixture class:

// Acme/SecurityBundle/DataFixtures/ORM/LoadUserData.php
<?php

namespace Acme\SecurityBundle\DataFixtures\ORM;

use Doctrine\Common\DataFixtures\FixtureInterface;
use Doctrine\Common\Persistence\ObjectManager;

use Acme\SecurityBundle\Entity\User;

class LoadUserData implements FixtureInterface
{
    public function load(ObjectManager $manager)
    {
        $userAdmin = new User();
        $userAdmin->setUsername('System');
        $userAdmin->setEmail('system@example.com');
        $userAdmin->setPassword('test');

        $manager->persist($userAdmin);
        $manager->flush();
    }
}

And the relevant database output:

id  username    email               salt                                password
1   System      system@example.com  3f92m2tqa2kg8cookg84s4sow80880g     test

score 85 · Accepted Answer · edited Jun 18 '13 at 22:56

85

Since you are using FOSUserBundle, you can use UserManager to do this. I would use this code (assuming you have $this->container set):

public function load(ObjectManager $manager)
{
    $userManager = $this->container->get('fos_user.user_manager');

    $userAdmin = $userManager->createUser();

    $userAdmin->setUsername('System');
    $userAdmin->setEmail('system@example.com');
    $userAdmin->setPlainPassword('test');
    $userAdmin->setEnabled(true);

    $userManager->updateUser($userAdmin, true);
}

edited Jun 18 '13 at 22:56

Ascherer

8,223
3
42
60

answered Feb 08 '12 at 20:36

Anton Babenko

6,586
2
36
44

5

Thanks for the UserManager tip! – Rodney Folz Feb 10 '12 at 03:25
2

I cant call the "get" method on "this" object when I try to build the fixtures onto the DB: PHP Fatal error: Call to undefined method [...]/UserFixtures::get() – JavierIEH Sep 04 '12 at 13:30
2

@JavierIEH You need to implement ContainerAwareInterface and ContainerInterface in your fixtures class. See 'using the container in the fixtures' here: https://raw.github.com/doctrine/DoctrineFixturesBundle/master/Resources/doc/index.rst. Anton Babenko, can you modify your answer to show this please? – nealio82 Sep 25 '12 at 10:28
2

I believe this is what @RodneyFolz has described in his answer already. – Anton Babenko Sep 25 '12 at 16:00
3

This is NOT an answer to YOUR QUESTION - it's just a workaround by using the FOSUserBundle. The correct answer is written down under by Rodney Folz... – thorinkor May 14 '13 at 10:56
1

not so fast @thorinkor. There is a tag for FOSUserBundle, it would appear that this IS in fact an answer for HIS question. Nor is this a workaround, but the actual suggested solution. – Ascherer Jun 18 '13 at 22:55

Rodney Folz · Answer 2 · 2013-10-15T21:01:28.627

Call setPlainPassword instead.

<?php

namespace Acme\SecurityBundle\DataFixtures\ORM;

use Doctrine\Common\DataFixtures\FixtureInterface;
use Symfony\Component\DependencyInjection\ContainerAwareInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Doctrine\Common\Persistence\ObjectManager;

use Acme\SecurityBundle\Entity\User;

class LoadUserData implements FixtureInterface, ContainerAwareInterface
{
    private $container;

    public function setContainer(ContainerInterface $container = null)
    {
        $this->container = $container;
    }

    public function load(ObjectManager $manager)
    {

        $userAdmin = new User();

        $userAdmin->setUsername('System');
        $userAdmin->setEmail('system@example.com');            
        $userAdmin->setPlainPassword('test');
        $userAdmin->setRoles(array('ROLE_SUPER_ADMIN'));

        $manager->persist($userAdmin);
        $manager->flush();
    }
}

Please watch out while updating. Then the user manager is usefull. http://stackoverflow.com/a/9200996/1815881 — Athlan, Jul 23 '14 at 14:52

score 8 · Answer 3 · edited Nov 15 '13 at 10:51

8

Four lines of code and you are done. It will handle everything for you:

        $userManager = $this->container->get('fos_user.user_manager');
        $user->setPlainPassword($password);
        $userManager->updatePassword($user);

edited Nov 15 '13 at 10:51

Rick Slinkman

643
10
23

answered Sep 24 '13 at 19:11

kratos

2,465
2
27
45

I had the problem with updating password field during reset password and your solution just fixed it, thanks – Alireza Jul 25 '16 at 07:44

score 6 · Answer 4 · answered Sep 04 '12 at 13:43

This worked for me

  public function load(ObjectManager $manager){
    $userAdmin = new User();
    $userAdmin->setUsername('admin');
    $userAdmin->setPlainPassword('admin');
    $userAdmin->setEmail('admin@gmail.com');
    $userAdmin->setEnabled(true);

    $manager->persist($userAdmin);
    $manager->flush();
  }

Note the difference when setting the password. Querying the database you find

id  username    username_canonical  email              email_canonical  enabled salt                            password    
  2 admin       admin               admin@gmail.com    admin@gmail.com  1       4gm0bx6jzocgksw0wws8kck04kg40o8 m2ZyJM2+oBIzt/NZdnOX4nFvjV/SWTU1qJqe6dWZ0UwLF5gB8N...

Please watch out while updating. Then the user manager is usefull. http://stackoverflow.com/a/9200996/1815881 — Athlan, Jul 23 '14 at 14:53

score 2 · Answer 5 · edited Feb 29 '16 at 11:23

2

$userAdmin->setUsername('System');
$userAdmin->setEmail('system@example.com');
$userAdmin->setPlainPassword('test');
$userAdmin->setEnabled(true);

setPlainPassword works for me.

edited Feb 29 '16 at 11:23

ssuperczynski

3,190
3
44
61

answered Dec 04 '13 at 07:21

Ali Hassan

607
1
11
24

score 2 · Answer 6 · answered Dec 22 '16 at 03:58

/**
 * 添加用户
 * @param $param
 * @return int
 */
public function doAdd($param)
{
    $entity = new User();
    $em = $this->getEntityManager();
    $entity->setUsername($param['username'])
        ->setPlainPassword($param['password'])
        ->setEmail($param['email'])
        ->setEnabled(true)
        ->setRealName($param['realName']);

    $em->persist($entity);
    $em->flush();
    return $entity->getId();
}

Above worked for me, so I got some conclusion:
1. must use the setPlainPassword
2. must setEnabled(true)

score 0 · Answer 7 · answered Jan 19 '16 at 18:48

Here a sample class to create an admin user via ORM Fixtures:

<?php

namespace Acme\SecurityBundle\DataFixtures\ORM;

use Doctrine\Common\DataFixtures\FixtureInterface;
use Symfony\Component\DependencyInjection\ContainerAwareInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Doctrine\Common\Persistence\ObjectManager;
use Doctrine\Common\DataFixtures\AbstractFixture;
use Doctrine\Common\DataFixtures\OrderedFixtureInterface;

use Acme\SecurityBundle\Entity\User;

class LoadFOSAdminUser extends AbstractFixture implements OrderedFixtureInterface, ContainerAwareInterface
{
    private $container;

    public function setContainer(ContainerInterface $container = null)
    {
        $this->container = $container;
    }

    public function load(ObjectManager $manager)
    {
        $userManager = $this->container->get('fos_user.user_manager');

        $userAdmin = $userManager->createUser();

        $userAdmin->setUsername('admin');
        $userAdmin->setEmail('admin@example.com');
        $userAdmin->setPlainPassword('admin');
        $userAdmin->setEnabled(true);
        $userAdmin->setRoles(array('ROLE_ADMIN'));

        $userManager->updateUser($userAdmin, true);
    }

    public function getOrder()
    {
        return 1;
    }
}

Symfony2 $user->setPassword() updates password as plain text [DataFixtures + FOSUserBundle]

7 Answers7

Linked