In hook_user(), bakery assumes that on an update op, the current user is the user being updated. This is not necessarily the case, and bakery should not mess with the current user's bakery session unless it is the case. I will include a patch which simply bypasses the functions when the current user and updated user are different, but this should be refactored to allow for the possibility without bypassing the update altogether.

CommentFileSizeAuthor
#4 bakery-clean_user_update-1691654-4.patch2.46 KBglennpratt
#2 bakery-clean_user_update-1691654-2.patch2.21 KBglennpratt
#1 bakery-clean_user_update-1691654-1.patch1.41 KBpdrake
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

pdrake’s picture

pdrake CreditAttribution: pdrake commented
Status: Active » Needs work
FileSize
bakery-clean_user_update-1691654-1.patch1.41 KB
glennpratt’s picture

glennpratt CreditAttribution: glennpratt commented
FileSize
bakery-clean_user_update-1691654-2.patch2.21 KB

So, one reason this fix is needed is if you have code, perhaps Feeds or Services that ends up calling many user_save's in one process.

glennpratt’s picture

glennpratt CreditAttribution: glennpratt commented
Status: Needs work » Needs review

I forgot to mention, another problem I had was that the Bakery cookie doesn't seem to get replaced when you update your own user account, so when you go to a slave site after changing your email address, you have a broken cookie with a link to repair which will try to set your email address to your old email address from the stale cookie.

glennpratt’s picture

glennpratt CreditAttribution: glennpratt commented
Title: bakery improperly assumes the current user is the one being updated » bakery_user overwrites a value in to pass data between hooks and doesn't rebuild cookie with new items.
FileSize
bakery-clean_user_update-1691654-4.patch2.46 KB

Whoops, bumping up patches fuzz to make a patch apply and not carefully checking the results is a bad idea!