All external login mechanisms (OpenID, Bakery, Facebook Connect, OAuth) logins bypass T&Cs

I'm ready to test it, but need the legal module updated to Drupal6.

Anyone want to try this out?

#2 patch doesn't add functionality required for OpenID to fully work with Legal module.

We need Legal to interrupt after the OpenID system has verified who the user is, during legal_user 'login' operation.

It should be possible to take the relevant code from the D6 version and add it to the D5 version. We'll see.

Any progress on this?

I'm also interested if anyone has found a fix for this issue.

same here

subscribing

This legal problem isn't just for openid users. What about anonymous commenters with the legal module?

Here is my suggestion. Under the openid login and the comment area there is a space to have a message that says (by logging in with openid/commenting you are accepting the terms.) The terms is a link to the terms page. There could even be an option for a checkbox that fails the form if not checked asking them to accept the terms.

This would be fairly straight forward to put into code. Does the idea work?

Thoughts?

This is also a problem for any bulk added users. We're bootstrapping a large user base using this module and by default they all had the terms accepted.

This is due to the hook_user insert operation which assumes if Drupal got to that point, the user has accepted... which may not be the case.

To solve this, and the openid issue, might be good to have some additional hook structure in there... for my problem, i solved it like this.

case 'insert':

        $conditions = legal_get_conditions();
        if (empty($conditions['conditions'])) return;

        $accepted = $edit['legal_accept'];
        
        $edit['legal_accept'] = NULL;

        ...
        ...

        // don't insert if there is no acceptance
        if ($accepted) {
            legal_save_accept($account->uid, $conditions['tc_id']);
        }

Here is a patch that also handles the 'update' case.

Thanks @pfournier for the patch! It doesn't look like it was properly formed however, so I rebuilt it in this patch (with a little documentation). I'm not quite sure what's going on with the branches in this project (7.x, 8.x, master, what's going on here?) so I rolled it against master, which looks like it's for Drupal 6 still.

I'm actually using this module with Facebook Connect, which also suffers the same problem. I'm updating the title issue to reflect the scope of the issue.

To be more clear, the user doesn't just *bypass* the T&C, they actually are marked as having accepted the conditions! That's much worse. I can't imagine the fight that might arise over a user who violated the terms of service arguing that they never even agreed to them to begin with.

Thanks dayre, pfournier, and quicksketch.

I tested with OpenID and works beautifully.

Committed, and will be part of a release today.

Re branches: - master and 6.x-8.x are currently the same, I jumped up to 6.x-8.x because I had previously accidentally created a 6.x-7.x branch which was never actually developed on, and just wanted to make a fresh start.

Ah yes, classic. I'd be lying if I said I never made a 6.x-6.x release accidentally. :P I'm happy the new project Git mechanism is much less prone-to-error.

Thanks for committing (and for really pulling this module out of the pits!)