Posted by ksenzee on December 14, 2011 at 7:29pm
5 followers
| Project: | Secure Password Hashes |
| Version: | 5.x-2.x-dev |
| Component: | Code |
| Category: | bug report |
| Priority: | critical |
| Assigned: | Unassigned |
| Status: | patch (to be ported) |
Issue Summary
With phpass installed, calls to user_authenticate() fail. This is because user_authenticate() calls user_load() with an array of user information that includes a plaintext password, and user_load() has a hardcoded md5() call to resolve the password. pwolanin suggested a core patch to be shipped with phpass, which is the only solution I can think of as well.
Comments
#1
Not sure if this is the right idea or not. It looks like once phpass is installed it's there for good, so I didn't add a module_exists check. I also didn't write it in such a way as to be acceptable in the core queue - getting it into core doesn't seem like an achievable goal. But maybe I'm a pessimist.
#2
How did this not come up before?
#3
It's not a facility used by core, only by external authentication modules using the password. I was aware it could be an issue, but didn't seem critical.
Patch looks reasonable to me - I think if you apply this patch you are not going to disable phpass. The only value I could see to a module_exists check would be that the patch could be applied prior to phpass being installed.
#4
Ok, well discovered now that user_authenticate() *is* used by core when you have email verification disabled for user registration.
I think in addition to supplying this patch with the module, we need to make the module work around that problem absent the patch.
#5
Here's a patch for the module itself that works around the authentication failure.
The core registration code flow is very wonky, but I think the logic here is both correct and minimal.
#6
oops missed-used an undefined $form_values that should be $form_state['values']
#7
we could perhaps add a define() to the core patch? That way we can 100% skip the extra submit function if the core patch is applied.
#8
with code comment
#9
corresponding module patch
#10
full patch
#11
committed to 6.x