Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-7560

CRM_Utils_System_Drupal::authenticate() uses raw SQL instead of Drupal API

    Details

    • Type: Improvement
    • Status: Done/Fixed
    • Priority: Minor
    • Resolution: Won't Fix
    • Affects Version/s: 3.3.5
    • Fix Version/s: 4.4.0
    • Labels:
      None

      Description

      For internal reasons we had to patch our Drupal install to use SHA1 password hashes instead of MD5 hashes. We also run bin/ContributionProcessor.php on a daily basis, but I noticed recently that it had quit working. I tracked the problem down to line 235 of CRM/Utils/System/Drupal.php where CRM_Utils_System_Drupal::authenticate() manually MD5 hashes the submitted password, which was causing authentication to fail in our environment. It occurs to me that ideally CiviCRM should be using Drupal's API instead of making assumptions about the underlying database and submitting raw SQL queries. In this case it's because we modified our Drupal install, but it's also easy to imagine Drupal making changes to core in a future release, thereby breaking static CiviCRM code.

      The attached patch fixes this problem for us, in this one function. The patch borrows from the code in this same file (CRM_Utils_System_Drupal::loadBootStrap()), in which Drupal's API is used, so I presume that using Drupal's API is the desired result, but that it was just overlooked in this one place.

      http://code.creativecommons.org/viewgit/civicrm.git/commit/?h=cc_production_3.3.5&id=670c33eae4acca6efae21ab39a45e2e6d5111b70

        Attachments

          Activity

            People

            • Assignee:
              lobo Donald A. Lobo
              Reporter:
              nkinkade Nathan Kinkade
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: