如何在Symfony2中设置密码长度限制？

Question

I tried with @Assert\\MinLength but it seems to check after encoding the password when it's long enought in everycase. How to put the constraint before encoding?

I can't think of anything better that to count the number of symbols with strlen after binding the registration form, but I don't think this will be a good way. And also I'm not sure that even this will work, I'm not sure when exactly the encoding is done.

Any suggestions will be appreciated! Thank you in advance!

Answer 1

The problem is that you're using one field for two purposes: storing a password in plain text and encoded form. What you need is a field for each purpose:

use Symfony\Component\Validator\Constraints\NotBlank;
use Symfony\Component\Validator\Constraints\MinLength;
use Doctrine\ORM\Mapping\Column;

class User 
{
    /**
     * @NotBlank
     * @MinLength(6)
     *
     * @var string
     */
    private $plainPassword;

    /**
     * @Column
     *
     * @var string
     */
    private $password;
}

Only the $password field is persisted to the database and it's not shown in forms so that users can't edit it.

Also you need a Doctrine event listener — or some other code — that checks if $plainPassword is not empty, and if it's not, encode its value and put it into $password .

Use the security.encoder_factory service to get the encoder you've setup in your security configuration and use it to encode passwords. Also, check my ElnurBlowfishPasswordEncoderBundle .

Answer 2

You shouldn't encode password by yourself in password setter. Instead of that use some encoder (you even can write your own encoder), and encode password after form is validated.

Here is example how you use encoders:

http://symfony.com/doc/current/book/security.html#encoding-the-user-s-password