Understanding Joomla login logic

Question

I'm fairly new to Joomla and Php in general. I need to understand how does Joomla perform login operation. The following is the php snippet that performs the operation:

<form action="<?php echo JRoute::_('index.php?option=com_users&task=user.login'); ?>" method="post">

        <fieldset>
            <?php foreach ($this->form->getFieldset('credentials') as $field): ?>
                <?php if (!$field->hidden): ?>
                    <div class="login-fields"><?php echo $field->label; ?>
                    <?php echo $field->input; ?></div>
                <?php endif; ?>
            <?php endforeach; ?>
            <?php if (JPluginHelper::isEnabled('system', 'remember')) : ?>
            <div class="login-fields">
                <label id="remember-lbl" for="remember"><?php echo JText::_('JGLOBAL_REMEMBER_ME') ?></label>
                <input id="remember" type="checkbox" name="remember" class="inputbox" value="yes"  alt="<?php echo JText::_('JGLOBAL_REMEMBER_ME') ?>" />
            </div>
            <?php endif; ?>
        <button type="submit" class="button"><?php echo JText::_('JLOGIN'); ?></button>
            <input type="hidden" name="return" value="<?php echo base64_encode($this->params->get('login_redirect_url', $this->form->getValue('return'))); ?>" />
            <?php echo JHtml::_('form.token'); ?>
        </fieldset>
    </form>

To my understanding, the first line perform POST request to post username and password to the server. In addition, a session token, should be retrieved upon successful validation. The part task=user.login means it is taking you to controller file "user" to the function "login". \components\com_users\controllers\user.php and find the function login.I understand also that Joomla has its own method to check the form token. You can JSession::checkToken('post') or jexit(JText::_('JInvalid_Token')).

However, my understanding for login process, is that this function login should send POST request to the server with username and password (credentials), and then the server will validate and send back a sessionToken.

The problem is, I could not understand in the below function, where the credentials are being sent via POST request? and where the sessionToken is received? I supposed there must be some URL to send POST, where is that?

public function login()
{
    JSession::checkToken('post') or jexit(JText::_('JInvalid_Token'));

    $app = JFactory::getApplication();

    // Populate the data array:
    $data = array();
    $data['return'] = base64_decode(JRequest::getVar('return', '', 'POST', 'BASE64'));
    $data['username'] = JRequest::getVar('username', '', 'method', 'username');
    $data['password'] = JRequest::getString('password', '', 'post', JREQUEST_ALLOWRAW);
    $lang = JRequest::getVar('lang','post');

    // Set the return URL if empty.
    if (empty($data['return'])) {
        $data['return'] = 'index.php?option=com_users&view=profile';
    }else {
        if($lang){
            $lang = mb_substr($lang, 0, 2);
            $data['return'] .= '&lang='.$lang;
        }
    }


    // Set the return URL in the user state to allow modification by plugins
    $app->setUserState('users.login.form.return', $data['return']);

    // Get the log in options.
    $options = array();
    $options['remember'] = JRequest::getBool('remember', false);
    $options['return'] = $data['return'];

    // Get the log in credentials.
    $credentials = array();
    $credentials['username'] = $data['username'];
    $credentials['password'] = $data['password'];

    // Perform the log in.
    if (true === $app->login($credentials, $options)) {
        // Success
        $app->setUserState('users.login.form.data', array());
        $app->redirect(JRoute::_($app->getUserState('users.login.form.return'), false));
    } else {
        // Login failed !
        $data['remember'] = (int)$options['remember'];
        $app->setUserState('users.login.form.data', $data);
        $app->redirect(JRoute::_('index.php?option=com_users&view=login', false));
    }
}

My objective is to mimic the request using JavaScript so that I can perform login using external mobile App. In other words, I need to write the same logic in JavaScript so I can login to the website from mobile App..

You may want to consider asking your question over at Joomla Stack Exchange — Lodder

borracciaBlu borracciaBlu · Accepted Answer · 2015-03-12T23:45:04

The files you have to investigate are :

libraries/legacy/application/application.php
libraries/joomla/factory.php
libraries/joomla/user/user.php

The key point of the login is :

// Perform the log in.
if (true === $app->login($credentials, $options))

In which:

@see libraries/legacy/application/application.php
$app = instance of JApplication

As the comment said the method login of Japplication is performing the login, generating the session and storing the user details.

To be more precise in JApplication::login You'll find this line.

$user = JFactory::getUser();

And it's exactly in this place that the session is initialised.

Understanding Joomla login logic

1 Answers