Question

I am using cakePHP 2.0 and am busy with a user management form for my site. The issue is that when I recall the user information row from the database, it reads the password in its ecrypted form and then populates the form element with a long string (I am assuming the encrypted password).

On save, my validation rules break because I limit to 8 characters (which is a good thing because I dont want to save the encrypted version of a password).

I also cannot leave the field blank because it may result in people saving and failing the validation rules again (no password entered)

What is the best way to overcome this? I thought about replacing the row’s populated password with an 8 character dummy password and do a validation check, however, that will not work because a) someone MAY use the same password and b) I will need to do another find to get the original password again which does not make sense.

Any help?

 // Controller EDIT:
 public function edit($id = null) {
    $this->User->id = $id;
    if(!$this->User->exists()) {
       $this->Session->setFlash(__('The user does not exist'));
       $this->redirect(array('action' => 'index'));
    } else {
        if($this->request->is('post') || $this->request->is('put')) {
            if($this->User->save($this->request->data)) {
                $this->Session->setFlash('The user has been updated','default',array('class'=>'success'));
                $this->redirect(array('action' => 'index'));
            } else {
                $this->Session->setFlash(__('The user could not be saved. Please, try again.'));
            }
        }
        $this->request->data = $this->User->read(null, $id);
        $userTypes = $this->User->UserType->find("list");
        $userStatuses = $this->User->UserStatus->find("list");
        $this->set(compact("userTypes","userStatuses"));
    }

}

 // HTML Form:
 <?php echo $this->Form->create('User');?>
<fieldset>
    <legend><?php echo __('Modify User '); ?></legend>
    <h3><?php echo $this->Html->link("Return to user index",array("controller" => "users","action" => "index")); ?></h3>
<?php
    echo $this->Form->input('username');
    echo $this->Form->input('password',array("id" => "profilePassword","empty" => true, "autocomplete" => "off"));
    echo $this->Form->input('company');
    echo $this->Form->input('first_name');
    echo $this->Form->input('last_name');
    echo $this->Form->input('telephone');
    echo $this->Form->input('fax');
    echo $this->Form->input('user_status_id');
    echo $this->Form->input('user_type_id');
?>
</fieldset>
 <?php echo $this->Form->end(__('Update'));?>

Answer 1

you should unset password if it’s empty (user didn’t wanted to change it)

before you save your model try:

if(empty($this->request->data[$this->alias]['password'])) {
    unset($this->request->data[$this->alias]['password']);
}

this way if user wants to change the password it will be validated, and if he doesn’t change it it will not update and will pass validation. You also can not require password field in validation rules or it will never pass in case user don’t change the password. Instead set rules like length limit ect…