Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
Shield module previously allowed disabling its functionality by setting the username field to blank. This was taken away in #3052725: Let empty user no more disable shield as it's redundant - there's already a config option to disable shield and that should be used instead.
As a result of that change, sites that had it set to enabled BUT had no username set, now have the auth dialog showing. That issue needed an update hook to disable shield if no username was set to preserve previous functionality.
Steps to reproduce
Proposed resolution
Remaining tasks
User interface changes
API changes
Data model changes
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | shield-disable-if-empty-user-3257878-3.patch | 704 bytes | vbouchet |
Comments
Comment #2
arakwarWe just had the same issue here. Since the only place we're disabling shield is in production, we couldn't foresee the issue.
That was quite a surprise when 15 websites got offline all at the same time.
I do think that such a change should have been listed in the release note...
Comment #3
vbouchetPlease find a patch which is disabling shield if username is empty.
When I resumed work on #3052725, I concentrated only on the latest feedback and this case was missing. Given the latest feedback was 2 years old, it is hard to get the context at this time and potentially it was not yet applicable.
Anyway, it was listed in the 1.5 release notes: https://www.drupal.org/project/shield/releases/8.x-1.5 as "#3052725: Let empty user no more disable shield" but it was probably not clear enough it may have impact on existing sites.
Comment #4
vbouchetComment #6
vbouchetAutomatic tests are passing.
I manually tested it with the following steps:
- Checkout commit 96b5d5fd148561f36fa725db26c79a4ee6f9eba3 (blank user still disabling shield)
- Configure Shield with "Enabled" => checked, empty user, filled password
- Visit pages => no shield
- Checkout 8.x-1.x
- Run updb
- Visit random page, shield is prompted
- Apply the patch
- Run updb
- Visit random page, shield is not prompted
- Shield settings form show "Enabled" => unchecked, empty user, filled password.
I also followed the same with a filled user and confirm shield was still prompted after the patch.
Comment #8
arakwarIndeed, my bad :)