error with password_verify()

Question

good afternoon I’m having a problem in using the password_verif() it is not checking correctly to log in, it is falling right into the else with msg "incorrect password". someone could help me?

functions:

private function compararSenha($hash){
    return password_verify($this->getSenha(), $hash);
}

private function findEmail($campo){
    $consulta = parent::select($campo, 'funcionario', 'WHERE email = ?', 's', array($this->getEmail()));
    $result = $consulta->fetch_object();

    if($consulta->num_rows > 0){
        if($campo == 'senha'){
            return $result->senha;
        }else if($campo == 'email'){
            return true;
        }
    }else{
        return false;
    }

}

public function logar(){
    $msgResult = array();
    $resultSearchPass = $this->findEmail('senha');

    if($resultSearchPass){
        if($this->compararSenha($this->getSenha(), $resultSearchPass)){
            $consulta = parent::select('id', 'funcionario', 'WHERE email = ? AND senha = ?', 'ss', array($this->getEmail(), $this->getSenha()));
            $result = $consulta->fetch_object();

               if($consulta->num_rows > 0){
                    $_SESSION['idFuncionario'] = $result->id;
                    $_SESSION['logado'] = true;

                    $msgResult['tipo'] = 'success';
                    $msgResult['msg'] = "Login Efetuado com Sucesso!";
                    return json_encode($msgResult);
                }else{
                    $msgResult['tipo'] = 'error';
                    $msgResult['msg'] = 'Email ou Senha Incorretos!';
                    return json_encode($msgResult);
                }
            }else{
                $msgResult['tipo'] = 'error';
                $msgResult['msg'] = 'Senha Incorreta!';
                return json_encode($msgResult);
            }
        }else{
            $msgResult['tipo'] = 'error';
            $msgResult['msg'] = 'Email não Existe!';
            return json_encode($msgResult);
        }

    }

Answer 1

You are passing the wrong parameters to your method. Note the signature of your method:

private function compararSenha($hash){
    return password_verify($this->getSenha(), $hash);
}

She receives only the hash, because the password is searched in the object itself through the method getSenha(). So this method only needs to receive the hash and nothing more.

However, in your code you call this method by passing two arguments, the password and the hash and its function is using the password as hash, and discarding $resultSearchPass.

To fix this problem just change:

if ($this->compararSenha($this->getSenha(), $resultSearchPass)) {
    // ...
}

For:

if ($this->compararSenha($resultSearchPass)) {
    // ...
}