protected function beforeSave()
{
    if($this->isNewRecord)
    {
            $this->salt = md5(rand(10,10000) . $this->email);
            $this->password = md5($this->salt."#".$this->password);
    }
    else
            $this->password = $model->password; // this will never work, where are you defining model

    return parent::beforeSave();


}