You are here
更新时 排除空的密码 有大用
Well a password is always required right? So in that case you would do that check in the validation of your form. In the case of Laravel a Request class. After that the logical place would be the controller in my opinion
You should check this in your controller and make sure that the password field isn't posted when it's empty for example
if ($request->get('password') == '') {
$user->update($request->except('password'));
} else {
$user->update($request->all());
}
Please sign in or create an account to participate in this conversation.
来自 https://laracasts.com/discuss/channels/general-discussion/prevent-update-empty-password
update user: allow blank password
Auth users can edit their profile and also their password. Although the two password fields can remain blank. In this case the mysql password field should not be updated.
This is my Update method in de UserController:
public function update($userId, UserRequest $request){
$user = User::findOrFail($userId);
if ($request->has('password')){
$this->validate($request, [
'password' => 'required|confirmed|min:6',
]);
$request->request->set('password',bcrypt($request->password));
$request = $request->all();
}
else{
$request = $request->except(['password']);
}
$user->update($request);
Is this considered secure?
And Is this good practice, could the code be cleaner? And how should refactor this? just add private methods or repo pattern?
Thanks in advance!
I'd personally put the functionality in the "App/User.php".
I try and keep as much code out of my controllers as possible.
...well, if you're really trying to clean up, there are better places to put this than on the User model.
You could create an UpdateUser command / job / service class (take your pick).
Just do $request->all() and in the rules add sometimes to the password fields. This will allow Laravel to validate the password fields if they're set (in the request to update) but also allow it to pass if it's not present.
thank you for your reply!
@Mike Hopley That's exactly what ik would like to learn.
Currently i can make everything work, now i'm at the point to make use of Repositories, Service Classes, command, Jobs Just like https://laracasts.com/discuss/channels/laravel/models-repositories-service-classes-jobs-commands.
Any advice on where to start?
@bashy thanks, i've noticed that when a form field is not changed the query won't update that column at all.
When i change my 'name' and submit: (only the name column will update)
[0] => Array
(
[query] => update `users` set `name` = ?, `updated_at` = ? where `id` = ?
[bindings] => Array
(
[0] => Tone Why
[1] => 2015-10-08 08:51:37
[2] => 1
)
[time] => 0,82
)
when don't change any value and submit:
Array
(
)
big miscommunication from my part sorry!
来自 https://laracasts.com/discuss/channels/code-review/update-user-allow-blank-password?page=1
Prevent update empty password
Where is the right place to put the check of an empty value? In the model, or in the controller? In my model I have this mutator to hash the password before save it in the database:
public function setPasswordAttribute($password)
{
return $this->attributes['password'] = bcrypt($password);
}
But I need to do this check in the controller to prevent update password with an empty value:
if (trim($request->password) != '') {
$user->password = $request->password;
}
Where is the right place to put this check according to SOLID principles?
Well a password is always required right? So in that case you would do that check in the validation of your form. In the case of Laravel a Request class. After that the logical place would be the controller in my opinion
You should check this in your controller and make sure that the password field isn't posted when it's empty for example
if ($request->get('password') == '') {
$user->update($request->except('password'));
} else {
$user->update($request->all());
}
Please sign in or create an account to participate in this conversation.
Channels
来自 https://laracasts.com/discuss/channels/general-discussion/prevent-update-empty-password
Prevent update empty password
Where is the right place to put the check of an empty value? In the model, or in the controller? In my model I have this mutator to hash the password before save it in the database:
public function setPasswordAttribute($password) { return $this->attributes['password'] = bcrypt($password); }But I need to do this check in the controller to prevent update password with an empty value:
if (trim($request->password) != '') { $user->password = $request->password; }Where is the right place to put this check according to SOLID principles?