sfDoctrineGuard question

Question

Hi,

I'm trying to do a "i forgot my password" functionality. My problem is that if i try to do a Doctrine query and send password to email it retrieves password encrypted. I look at some webs that DoctrineGuard don't have this functionality and only have register and login functionality.

Is it true?

In this case, how i can do a remember password function?

thanks

Answer 1

Password are hashed and then save to the database, thus you can't recover the password once it has been saved.

There are several ways you can create a "password lost" function :

• Send a new password by email (not really secure but some people like it anyway)
• Send the user an email with a reset password link (and a unique token), which either gives the user a new password, or allow the user to enter a new password.

Answer 2

If I recall reading right, the sfDoctrineGuard doesn't have a "getPassword" method that would do what it needs to... retrieve the password unencrypted.

I'm using DuoSRX's first recommendation: creating a new password, saving it with $user->setPassword (which handles salting & hashing automatically), and emailing it to the user. The user is then advised to login and create a new password.