When an anonymous user would request a new password for an account or email address that didn't exist, an unhandled error would occur. The problematic function in user.module is user_pass(). The password or account is loaded with user_load(). The check relies on there being a false value returned. user_load() loads the account information, and if it fails it returns a StdClass() object.

Attached is a patch to check whether or not the relevant information was loaded correctly. I also changed the error handling to not depend on a null or false value.

Please feel free to email me with questions.

CommentFileSizeAuthor
#4 user.module.patch_4.txt262 bytesmagico
drupal-4.6.8-user.module.patch1.49 KBchamuco

Comments

stevenpatz’s picture

stevenpatz
he/him
commented

I just tested this using my install of 4.6.8 and what I get when I enter in a username and email that doesn't exist is this:

Sorry. The username dhsdhhsdhs is not recognized. 
You must provider either a username or e-mail address.
heine’s picture

heine commented

This is only an issue on PHP 5 where empty objects (new StdClass) are True.

magico’s picture

magico commented
Version: 4.6.8 » 4.6.9

I confirm this bug in 4.6.9 with PHP 5.0.4

magico’s picture

magico commented
Status: Active » Needs review
StatusFileSize
new user.module.patch_4.txt262 bytes

I checked the function user_load() in 4.7 and it returns a FALSE instead of a StdClass. Now the patch is very simple, but I request a comment from a senior developer to explain why in 4.6.9 was a StdClass returned instead of a FALSE?

Will this affect in anyway, other functions that rely on the result of user_load() ?

chx’s picture

chx commented
Status: Needs review » Needs work

for oldstable , i do not think this is acceptable. we must not change user_load return in a minor release..

magico’s picture

magico commented

@chx: so what is your opinion on how to solve this bug? The original patch provided in this issue?

magico’s picture

magico commented
Priority: Normal » Critical

This seems critical... so what do we do?

m3avrck’s picture

m3avrck commented
Version: 4.6.9 » 5.x-dev
chx’s picture

chx commented
Version: 5.x-dev » 4.6.9

Ted, explain before bumping versions. user_load now returns FALSE.

stevenpatz’s picture

stevenpatz
he/him
commented
Status: Needs work » Postponed (maintainer needs more info)

Is this still an issue? 4.6.x isn't supported anymore.

stevenpatz’s picture

stevenpatz
he/him
commented
Status: Postponed (maintainer needs more info) » Fixed
Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.