Details
-
Type: Bug
-
Status: Done/Fixed
-
Priority: Minor
-
Resolution: Won't Fix
-
Affects Version/s: 3.4.8
-
Fix Version/s: None
-
Component/s: CiviCRM API
-
Labels:None
Description
CRM_Utils_REST::loadBootStrap() in v3.4.x calls CRM_Utils_System::loadBootStrap() using function signature for v4.1.x, which means that CRM_Utils_System_Drupal::loadBootStrap() is passed 'TRUE' as the password parameter.
CRM_Utils_System::loadBootStrap() parameters changed between 3.4.x and 4.1.2. The old approach had $user and $pass as first and second parameters; the new approach uses an initial $params array for name/pass, and $loadUser as the second parameter.
By using the v4.x signature in v3.4.8 CRM/Utils/REST.php at line 541, the UF will receive "TRUE" as the password, and fail authentication for the user.
If no user/pass is supplied in the $pass parameter, CRM_Utils_System::loadBootStrap() will retrieve the data from the request and authenticate the request.