为什么 isPasswordValid() 函数总是返回 false？

Question

I am working on a simple reset password system with Symfony4.

I don't know why isPasswordValid() always return false ?

I am using Bcrypt to Hash the password Here is some code of Security.yaml :

security:
    encoders:
        App\Entity\User:
            algorithm: bcrypt

I don't know why isPasswordValid() Always returns false. I manually tried this:

$pass="000000000";
dump($encoder->isPasswordValid($user, $pass));
die();

and it dump false..

Here is the function I wrote on the controller:

/**
 * @Route("/password", name="change_pass", methods={"GET","POST"})
 * @IsGranted("ROLE_USER")
 */
public function edit(Request $request,UserPasswordEncoderInterface $encoder): Response
{

    $user = $this->getUser();

    $form = $this->createForm(ResetPassType::class, $user);
    $form->handleRequest($request);

    if ($form->isSubmitted() && $form->isValid()) {

        $oldPassword = $request->request->get('reset_pass')['oldPassword'];
        $newPassword = $user->getPassword();

        if ($encoder->isPasswordValid($user, $oldPassword)) {
            $hash = $encoder->encodePassword($user,$newPassword);
            $user->setPassword($hash);
            $this->getDoctrine()->getManager()->flush();
            $this->addFlash('success', 'Your password is succesfully changed');
        }else {
            $this->addFlash('fail', 'old password is wrong');
        }

    }
    $this->getDoctrine()->getManager()->refresh($user);

    return $this->render('consultant/changepass.html.twig', [
        'form' => $form->createView(),
    ]);
}

Here is the form ResetPassType :

   public function buildForm(FormBuilderInterface $builder, array $options)
    {
        $builder
        ->add('oldPassword', PasswordType::class, [
            'mapped' => false,])
        ->add('password',PasswordType::class)
        ;
    }

Answer 1

Short answer: you are using the new password as the old password's hash.

---

Explanation:
I guess you bound your form to your user class. The password field in your form is mapped , meaning it updates your user's password property.

Therefore, as the property should contain the hash of the "old password" but contains your new password, it can't validate.

---

Solution and improvements:
The quickest solution would be to "unmap" the password field or to remove the data_class form option, and to replace a line in your controller:

// before: $newPassword = $user->getPassword();
$newPassword = $form->get('password')->getData();

I'd suggest to:

• unbind the form to your user class
• use the UserPassword validation constraint for your oldPassword field
• fetch the form data using $form->getData() instead of accessing the $request manually

Answer 2

You will change your form because if you keep the field password, the password of the user will be changed by form too, so the right way is :

-in your Form :

public function buildForm(FormBuilderInterface $builder, array $options)
    {
        $builder
        ->add('oldPassword', PasswordType::class, [
            'mapped' => false,])
        ->add('newPassword',PasswordType::class, [
            'mapped' => false,])
        ;
    }

and then in your controller change the way you get the new password

$oldPassword = $request->request->get('reset_pass')['oldPassword'];
$newPassword = $request->request->get('reset_pass')['newPassword'];

Have fun :)