Symfony sfGuardPlugin password recovery

Question

I am supporting a site built on symfony. There were problems regarding some kind of "admin page".

While not knowing much about the whole thing by reading the logs and comparing recent backups I think I was able to fix the issue (some developer removed a route, but did not fix a template).

I do not have admin password to the site, but have root access to the server and super access to the database (in this case postgres).

Can you help me how to create myself an account without knowing the current passwords?

Disclaimer: I do not have much knowledge with PHP's OOP interface as I am not a programmer, but a sysadmin.

Edit:

symfony version 1.0.16

Answer 1

Try logging into the server and changing into the Symfony project's root directory. There's probably a "symfony" script/link there (the details depend on your OS and how Symfony's set up; you might be able just to run ./symfony rather than needing php symfony). Run this to see whether this basics are working:

php symfony

If that works, you should get a list of possible tasks you can do. If you're using the sfGuardPlugin, you should see some tasks like guard:create-user.

To get more information on a task, try something like:

php symfony help guard:create-user

But basically, assuming a fairly modern Symfony installation and plugin, try something like:

php symfony guard:create-user --env=prod newusername newpassword

(the --env=prod option creates the user in the production environment, which is probably what you want.)

If there are super-user-only tasks you want to do, try also doing this:

php symfony guard:promote newusername

That will give the new user super-admin privileges.

You'll probably also find a guard:change-password task which will simply reset the password for a given user.

Answer 2

I ended up editing the file named:

plugins/sfGuardPlugin/lib/validator/sfGuardUserValidator.class.php

this is where the authentication takes place. I added a few lines to bypass the actual password check for an already created user.