I'm fairly new to mvc and almost finished my auth class I wanted to check that I'm using it all correctly any feedback would be welcome. I used the PIP framework to get started http://gilbitron.github.com/PIP/
here's the controller
<?php
class Auth extends Controller {
protected $username;
protected $password;
public $action;
private $user;
function index()
{
$template = $this->loadView('login');
$template->render();
}
function login()
{
$this->username = $_POST['username'];
$this->password = $_POST['password'];
$this->action = $_POST['which_action'];
$login = $this->loadModel('auth_model');
// pass the user details
if($this->action=="login") {
$login = $login->do_login($this->username,encrypt_password($this->password));
switch($login[0]->active) {
case "0":
$this->redirect('auth/login/disabled');
break;
case "1":
$this->redirect('dashboard/');
break;
default:
$this->redirect('auth/login/error');
break;
}
}
$template = $this->loadView('login');
$notification = $this->loadHelper('notification_helper');
// check if the user is active or not
$url = $this->loadHelper('url_helper');
switch($url->segment(3)) {
// account disabled
case "disabled":
$template->set('login_result', $notification->show_notification(1));
break;
// wrong login details
case "error":
$template->set('login_result', $notification->show_notification(2));
break;
// password reset
case "reset":
$template->set('login_result', $notification->show_notification(3));
break;
case "reseterror":
$template->set('login_result', $notification->show_notification(3));
break;
case "changed":
$template->set('login_result', $notification->show_notification(6));
break;
}
$template->render();
}
function resetPassword() {
$this->username = $_POST['username'];
$this->password = $_POST['password'];
$login = $this->loadModel('auth_model');
$notification = $this->loadHelper('notification_helper');
$url = $this->loadHelper('url_helper');
$template = $this->loadView('reset_password');
// The form has been posted lets reset the password
if($url->segment(3)==1) {
$login->reset_password($this->username,getrandomstring(9));
$check_reset = $login->check_reset($this->username);
$this->user = $check_reset[0];
switch($this->user->password_reset) {
case 1:
// success
$email = $this->loadHelper('mail_helper');
$email->send_template(1,$this->user,array($this->user->first_name." ".$this->user->last_name => $this->user->email));
// the email was sent
if($email->status=="sent") {
$this->redirect('auth/login/reset');
} else {
// something went wrong
$this->redirect('auth/login/reseterror');
}
break;
case 0:
// failure
if($this->user->active!=0) {
$template->set('password_result', $notification->show_notification(4));
} else {
// account disabled
$this->redirect('auth/login/disabled');
}
break;
}
}
if($url->segment(3)=="confirm") {
// first lets check this is a real request
$user = $login->get_user($url->segment(4),$url->segment(5));
if($user[0]->active==1) {
$template = $this->loadView('change_password');
//password change procedure
if($this->action=="change") {
// verify the new password matches
if($_POST['password']==$_POST['password_confirm']) {
//crypt the password
$password = encrypt_password($this->password);
//update the account
$login->change_password($url->segment(4),$password);
//redirect to login
$this->redirect('auth/login/changed');
// Receive an email
//$email->send_template(1,$check_reset[0]);
} else {
// return an error
$template->set('password_result', $notification->show_notification(7));
}
}
} else {
// kick them back to the login screen
$this->redirect('auth/login/reseterror');
}
}
$template->render();
// 2. Receive an email with a link to reset password
}
}
?>
and model
<?php
class Auth_model extends Model {
public function do_login($username,$password)
{
$q_params = array('username' => $username,'password' => $password);
$result = $this->query("SELECT * FROM a_users where user_name = :username AND password = :password",$q_params);
return $result;
}
public function reset_password($username,$seed)
{
$q_params = array('username' => $username,'active' => '1','reset' => '1','reset_key' => $seed);
$result = $this->query_update("UPDATE a_users SET password_reset = :reset,password_reset_key = :reset_key where user_name = :username AND active = :active",$q_params);
return $result;
}
public function check_reset($username)
{
$q_params = array('username' => $username,'active' => '1');
$result = $this->query("SELECT * FROM a_users where user_name = :username AND active = :active",$q_params);
return $result;
}
public function get_user($user_id,$random)
{
$q_params = array('password_reset_key' => $random,'user_id' => $user_id, 'active' => '1');
$result = $this->query("SELECT * FROM a_users where user_id = :user_id AND password_reset_key = :password_reset_key AND active = :active",$q_params);
return $result;
}
public function change_password($user_id,$password)
{
$q_params = array('password_reset' => 0,'password' => $password,'user_id' => $user_id, 'active' => '1');
$result = $this->query_update("UPDATE a_users SET password = :password, password_reset = :password_reset where user_id = :user_id AND active = :active",$q_params);
return $result;
}
}
?>
