The module does not check if the password was changed [#2044237]

When saving a password, there is no check for whether the password has changed or not. A variable is created, but it is not checked.

What sometimes happens is that the function _protected_node_save() is called twice during a node save, and without the check, the saved hash is a hash of the hash of the entered password.

The attached patch corrects this.

Comment	File	Size	Author
	protected_node-check_for_changed_password.patch	1.53 KB	oadaeh

Comments

Comment #1

grimreaper

French

France 🇫🇷

commented 13 November 2013 at 14:13

Hello,

Izus (the new co-maintener) asked me if I could help with the issues.

I discovered this module between yesterday and today so I could not see some problem (bug or feature problem).

I just have tested your patch and it's ok for me.

My test case :
- per node protection
- an article protected by a password
- I check that the hash of the password correspond to the hash in the database.
- I change the password
- I check that the hash of the password correspond to the hash in the database.
- ok

I change the status to tested and reviewed by the community.

Edit : I forget to mention that I had a difficulty to apply your patch (with eclipse) so I edit the file manually.