From 8281e37afee5a7809aed8edeae05d29a4929eacc Mon Sep 17 00:00:00 2001 From: Alexandr Kirienko Date: Mon, 9 Mar 2015 20:12:31 +0300 Subject: [PATCH] #2149661: Users with empty mail field. --- includes/fboauth.fboauth.inc | 160 ++++++++++++++++++++----------------------- 1 file changed, 75 insertions(+), 85 deletions(-) diff --git a/includes/fboauth.fboauth.inc b/includes/fboauth.fboauth.inc index dee43e4..de9a124 100644 --- a/includes/fboauth.fboauth.inc +++ b/includes/fboauth.fboauth.inc @@ -84,7 +84,7 @@ function fboauth_action_connect($app_id, $access_token) { $_SESSION['fboauth']['access_token'] = $access_token; $fbuser = fboauth_graph_query('me', $access_token); - + $uid = fboauth_uid_load($fbuser->id); // If the user isn't logged in. if (!$user->uid) { @@ -95,113 +95,103 @@ function fboauth_action_connect($app_id, $access_token) { // No association between FB & this Drupal site, yet. // So lets check & see if the FB address matches a Drupal email address. else { - if (!empty($fbuser->email)) { - $account = NULL; - - // Check and see if multiple_email module is in use. - if (module_exists('multiple_email')) { - if ($multiple_email_object = multiple_email_find_address($fbuser->email)) { - $account = user_load($multiple_email_object->uid); - if ($multiple_email_object->confirmed) { - // we're good - } - else { - // note: drupal security team doesn't consider it a vulnerabilty that UID is publicly available - // https://www.drupal.org/node/1004778 - drupal_set_message(t("We found your e-mail @email in the @sitename system, but it hasn't been confirmed. " . - 'Please login manually and then ' . - 'resend your confirmation code to confirm that you are the owner of this email address. This is required before you can connect to the site from Facebook with it.', - array( - '@email' => $fbuser->email, - '@sitename' => variable_get('site_name', ''), - '!login' => url('user/login'), - '!edit' => url('user/' . $account->uid . '/edit/email-addresses')))); - return; - } - } + $account = NULL; + + // Check and see if multiple_email module is in use. + if (module_exists('multiple_email')) { + if ($multiple_email_object = multiple_email_find_address($fbuser->email)) { + $account = user_load($multiple_email_object->uid); + if ($multiple_email_object->confirmed) { + // we're good + } else { - // Email address not found in System + // note: drupal security team doesn't consider it a vulnerabilty that UID is publicly available + // https://www.drupal.org/node/1004778 + drupal_set_message(t("We found your e-mail @email in the @sitename system, but it hasn't been confirmed. " . + 'Please login manually and then ' . + 'resend your confirmation code to confirm that you are the owner of this email address. This is required before you can connect to the site from Facebook with it.', + array( + '@email' => $fbuser->email, + '@sitename' => variable_get('site_name', ''), + '!login' => url('user/login'), + '!edit' => url('user/' . $account->uid . '/edit/email-addresses')))); + return; } } else { - // Just use the e-mail from the users table. - $account = user_load_by_mail($fbuser->email); + // Email address not found in System } - // If the Facebook e-mail address matches an existing account, bind them - // together and log in as that account. - if ($account) { - // Connect the account only if we allow anonymous users to connect accounts that have - // never been connected before. - if (variable_get('fboauth_anon_connect', TRUE)) { - // Logins will be denied if the user's account is blocked. - if (fboauth_login_user($account)) { - fboauth_save($account->uid, $fbuser->id); - drupal_set_message(t("You've connected your account with Facebook.")); - } + } + else { + // Just use the e-mail from the users table. + $account = user_load_by_mail($fbuser->email); + } + // If the Facebook e-mail address matches an existing account, bind them + // together and log in as that account. + if ($account) { + // Connect the account only if we allow anonymous users to connect accounts that have + // never been connected before. + if (variable_get('fboauth_anon_connect', TRUE)) { + // Logins will be denied if the user's account is blocked. + if (fboauth_login_user($account)) { + fboauth_save($account->uid, $fbuser->id); + drupal_set_message(t("You've connected your account with Facebook.")); } - else { - drupal_set_message(t('We found your e-mail @email in the @sitename system, but the account has never been connected to Facebook before. ' . + } + else { + drupal_set_message(t('We found your e-mail @email in the @sitename system, but the account has never been connected to Facebook before. ' . 'Please login manually and connect to Facebook while logged in. ' . 'Once you have completed this step, you may login through Facebook whenever you like.', array( - '@email' => $fbuser->email, - '@sitename' => variable_get('site_name', ''), - '!login' => url('user/login'), - '!edit' => url('user/' . $account->uid . '/edit')))); - } + '@email' => $fbuser->email, + '@sitename' => variable_get('site_name', ''), + '!login' => url('user/login'), + '!edit' => url('user/' . $account->uid . '/edit')))); } - // Register a new user only if allowed. - elseif (variable_get('user_register', 1)) { - $account = fboauth_create_user($fbuser); + } + // Register a new user only if allowed. + elseif (variable_get('user_register', 1)) { + $account = fboauth_create_user($fbuser); - if ( !isset($account) || empty($account) ) { - drupal_set_message(t('Unable to create a new account using your Facebook profile.'), 'warning'); - return; - } + if ( !isset($account) || empty($account) ) { + drupal_set_message(t('Unable to create a new account using your Facebook profile.'), 'warning'); + return; + } - // Load the account fresh just to have a fully-loaded object. - $account = user_load($account->uid); + // Load the account fresh just to have a fully-loaded object. + $account = user_load($account->uid); - // If the account requires administrator approval the new account will - // have a status of '0' and not be activated yet. - if ($account->status == 0) { - _user_mail_notify('register_pending_approval', $account); - drupal_set_message( + // If the account requires administrator approval the new account will + // have a status of '0' and not be activated yet. + if ($account->status == 0) { + _user_mail_notify('register_pending_approval', $account); + drupal_set_message( t('An account has been created for you on @sitename but an ' . 'administrator needs to approve your account. In the meantime, ' . 'a welcome message with further instructions has been sent ' . 'to your e-mail address.', array( '@sitename' => variable_get('site_name', '')))); - } - // Log in the user if no approval is required. - elseif (fboauth_login_user($account)) { - drupal_set_message(t('Welcome to @sitename. ' . - 'Basic information has been imported from Facebook into your account. ' . - 'You may want to edit your account to confirm the ' . - 'details and set a password.', - array( - '@sitename' => variable_get('site_name', ''), - '!edit' => url('user/' . $account->uid . '/edit')))); - } - // If the login fails, fboauth_login_user() throws an error message. } - // Since user's can't create new accounts on their own, show an error. - else { - drupal_set_message(t('Your Facebook e-mail address does not match - any existing accounts. If you have an account, you must first - log in before you can connect your account to Facebook. - Creation of new accounts on this site is disabled.')); + // Log in the user if no approval is required. + elseif (fboauth_login_user($account)) { + drupal_set_message(t('Welcome to @sitename. ' . + 'Basic information has been imported from Facebook into your account. ' . + 'You may want to edit your account to confirm the ' . + 'details and set a password.', + array( + '@sitename' => variable_get('site_name', ''), + '!edit' => url('user/' . $account->uid . '/edit')))); } + // If the login fails, fboauth_login_user() throws an error message. } - // Email not provided by Facebook. + // Since user's can't create new accounts on their own, show an error. else { - drupal_set_message(t("Facebook didn't provide an e-mail address " . - "to be associated with your account, so we can't compare it " . - "with the e-mail addresses in this system.")); - return; + drupal_set_message(t('Your Facebook e-mail address does not match + any existing accounts. If you have an account, you must first + log in before you can connect your account to Facebook. + Creation of new accounts on this site is disabled.')); } - // Done if no e-mail address provided by facebook. } } else { @@ -273,7 +263,7 @@ function fboauth_create_user($fbuser, $options = array()) { // get the facebook e-mail address in case the main e-mail address isn't available from facebook. // this still will fail if the Facebook user hasn't set a Facebook username, since per // https://www.drupal.org/node/2149661#comment-9623017 #6 the fbid with @facebook.com isn't a valid email. - $facebook_mail = isset($fbuser->username) ? $fbuser->username . '@facebook.com' : ''; + $facebook_mail = $fbuser->id . '@facebook.com'; // Initialize basic properties that are unlikely to need changing. $edit = array( -- 1.9.1