Cannot override user authentication

Problem:

--

Attaching validations to the login form will not disrupt the login operation even if the validators set errors in the form fields..

--

sadly, it's an ugly trick in core user module, so fix should be done carefully to avoid breaking any other modules workflow..

Here are my findings on the issue:

Here is the validation hook for the login form:

function user_login_validate($form_id, $form_values) {
  if ($form_values['name']) {
    if (user_is_blocked($form_values['name'])) {
      // blocked in user administration
      form_set_error('login', t('The username %name has not been activated or is blocked.', array('%name' => $form_values['name'])));
    }
    else if (drupal_is_denied('user', $form_values['name'])) {
      // denied by access controls
      form_set_error('login', t('The name %name is a reserved username.', array('%name' => $form_values['name'])));
    }
    else if ($form_values['pass']) {
      $user = user_authenticate($form_values['name'], trim($form_values['pass']));

      if (!$user->uid) {
        form_set_error('login', t('Sorry, unrecognized username or password. <a href="@password">Have you forgotten your password?</a>', array('@password' => url('user/password'))));
        watchdog('user', t('Login attempt failed for %user.', array('%user' => $form_values['name'])));
      }
    }
  }
}

The user_authenticate actually loads the user if the auth is right..
And here is the submit hook for the login form:

function user_login_submit($form_id, $form_values) {
  global $user;
  if ($user->uid) {
    // To handle the edge case where this function is called during a
    // bootstrap, check for the existence of t().
    if (function_exists('t')) {
      $message = t('Session opened for %name.', array('%name' => $user->name));
    }
    else {
       $message = "Session opened for ". check_plain($user->name);
    }
    watchdog('user', $message);

    // Update the user table timestamp noting user has logged in.
    db_query("UPDATE {users} SET login = %d WHERE uid = %d", time(), $user->uid);

    user_module_invoke('login', $form_values, $user);

    sess_regenerate();
    return 'user/'. $user->uid;
  }
}

My reading about this submit hook, it's, somewhere in the flow the code is already loaded previous to reach the submit hook. As you can read the code, the user is not loaded in the submit hook, but it's comparing if the current session has a user ID to perform the login finishing operations, as log the entry and update last_login timestamp..

This is the reason why any other external validation will work with the login for, as the submit hook is not used to actually login and load the user, but just to register the operation..

so.. where the user is loaded then?

Take a look at the authentication function:

function user_authenticate($name, $pass) {
  global $user;

  // Try to log in the user locally. Don't set $user unless successful.
  if ($account = user_load(array('name' => $name, 'pass' => $pass, 'status' => 1))) {
    $user = $account;
    return $user;
  }
  ...

Currently, what user_authenticate does is not only to check if the user and password for the non blocked user are right, but it also loads the user in the current session:


Definition
---------

user_authenticate($name, $pass)
modules/user/user.module, line 1218

Description
----------
Try to log in the user locally.

Return value
------------

A $user object, if successful.

So it's the login validation actually loading the user, before the other hooked validations return any error or even if there where any errors attached to the form.

It's an important flow error, I guess, but also it's an important change that may affect other modules..

Solutions...

1º break the form operation using drupal_goto in your validation function so the form will not continue executing validation hooks.. there's no way to ensure the login validation has not yet been executed.

2º modify one of the fields (name or pass) and overwritte user object if uid != 0 with guest data, so it will not login, or it's session will be deleted.

3º patch the user.module to load the user in the current session only in the submit operation, instead of the validation.

I think we can't go further here, but to report this as an issue for the core module. Hope this can help you!!