Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-10120

REST login in v3.4.8 doesn't get password supplied, cannot authenticate

    Details

    • Type: Bug
    • Status: Done/Fixed
    • Priority: Minor
    • Resolution: Won't Fix
    • Affects Version/s: 3.4.8
    • Fix Version/s: None
    • Component/s: CiviCRM API
    • Labels:
      None

      Description

      CRM_Utils_REST::loadBootStrap() in v3.4.x calls CRM_Utils_System::loadBootStrap() using function signature for v4.1.x, which means that CRM_Utils_System_Drupal::loadBootStrap() is passed 'TRUE' as the password parameter.

      CRM_Utils_System::loadBootStrap() parameters changed between 3.4.x and 4.1.2. The old approach had $user and $pass as first and second parameters; the new approach uses an initial $params array for name/pass, and $loadUser as the second parameter.

      By using the v4.x signature in v3.4.8 CRM/Utils/REST.php at line 541, the UF will receive "TRUE" as the password, and fail authentication for the user.

      If no user/pass is supplied in the $pass parameter, CRM_Utils_System::loadBootStrap() will retrieve the data from the request and authenticate the request.

        Attachments

          Activity

            People

            • Assignee:
              lobo Donald A. Lobo
              Reporter:
              xurizaemon Chris Burgess
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: