I've run into an issue when using user.save to register a new user. When user.save is called with a new user, it executes the register form, but that form should be run as an anonymous user. If the current service session is authenticated this causes a problem. I think that the code should drop to the anonymous user, run the form, and then come back to whatever user is logged in.
| Comment | File | Size | Author |
|---|---|---|---|
| #11 | user-resource-duplicate-user-load-1127378-11.patch | 912 bytes | glennpratt |
| #5 | user_service-1127378-5.patch | 958 bytes | abs_ts |
| #4 | user_service-1127378-4.patch | 967 bytes | abs_ts |
| #1 | user_service-1127378-1.patch | 1.03 KB | abs_ts |
Comments
Comment #1
abs_ts commentedHere's the patch.
Comment #2
abs_ts commentedI should clarify that this occurs in a situation where you are not giving anonymous users permissions to the user service, and require that all calls have a logged in user for security reasons. The current user.save code works fine if you can call user.save with an anonymous session, but in setups where anonymous doesn't have the required permissions to register a user the call returns with "access denied". The patch I supplied allows you to require remote calls be using a services user account, but still be able to run the registration form as anonymous.
Hopefully that makes sense.
Comment #3
marcingy commentedI'll be happy to commit this but there coding style issues plus
This is not needed
and
should be
And can't this block of code be simplified
to
Comment #4
abs_ts commentedOK. Let's try that again with a new patch.
Comment #5
abs_ts commentedI realized that I had some whitespace at the end of a line or two. Here's a corrected patch with the whitespace removed.
Comment #6
marcingy commentedCommited however I have just realised that this also needs to go into 3.x as well.
Comment #7
marcingy commentedComment #8
kylebrowning commentedSo, this actually broke the user resource so I removed it. feel free to get another patch in but please have it reviewed before committing.
Comment #9
glennpratt commentedIt appears this was applied to 6.x-3.x and not removed. This breaks things for me, because I need to be able to create a user as another user, not switch to anon, for a number of reasons.
In IRC, kylebrowning said he would remove it and replace it with a new register action to allow this functionality. See #1134872: Create register action for user resource
Comment #10
kylebrowning commentedThis workaround was fine for 2.x but in 3.x we decided to add the register method as #9 says.
Comment #11
glennpratt commentedThe previous patch introduced a redundant user_load. Because of other contrib modules, it doesn't work on my setup and clears the $form_state['user'] entry.
The reason this seems redundant is user_register_submit populates $form_state['user'].
http://api.drupal.org/api/drupal/modules--user--user.module/function/use...
This patch removes that as well. User resource tests are a little broken for me, but the tests related to user creation pass just the same.
Comment #12
kylebrowning commentedpatch in #11 has been tested, and fixed, it does not exist in 7.x therefore this is now fixed.