Problem/Motivation

As we realized during our meeting there is an issue with the way passwords were generated in D7 Protected Node. This appreach was different as the new one in Entity Access Password. It seems necessary that the passwords which were set in D7 still work in D9

Proposed resolution

  • Use the same password generation like in D7
  • Find a way to migrate the passwords (like the user passwords)

Maybe the problem could be mitigated if we introduce the new password generation method as third password hashing option in D7 so we have time to reset the passwords already in D7

Issue fork protected_node-3260323

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

meyerrob created an issue. See original summary.

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented
Assigned: Unassigned » grimreaper
grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented

Here are my tests results.

I have mounted a fresh and up-to-date Drupal 7 locally.

I have entered the password "bbb" for a user and for a node on both D7 and D9:

Protected node:
D7 bbb 3e744b9dc39389baf0c5a0660589b8402f3dbb49b89b3e75f2c9355852a3c677
D9 bbb $S$EpdBfSkmJ/kE50zOPmJTW8dNp3hsbGeKjCNNOFivo.JPL9GwN3Lx

Users:
D7 bbb $S$DuU.ufhmRZIze.ZFkBW3KD77QQ90NC4SUqmRY5SAHmXfL8lcEgG1
D9 bbb $S$EaQzYInBgo43Q81HDX8VGJuWEY6xv4UTk8FVWBwQjpLcPI.4PxXL

So in D7 no really possible to use the existing passwords as it for D9.

But I have taken the password hashed of the D7 user and put it into a D9 field value of the password field and it works!

I still don't quite understand how with some random parts in the password hashing process, so with the same password hashed differently!, and that when entering it in all the cases it is ok.

It is way more secure because with Protected Node D7 hashing mecanism, the password gives the same hash constantly so if someone crack it, it is possible to guess stuff.

So I guess we will patch D7 version to change the hashing mecanism to same as D7 for users.

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented
Title: Make passwords compatible with D7 protected node passwords » Use user password functions for easier migration from D7 to D8/9
Project: Entity Access Password » Protected Node
Version: 1.0.x-dev » 7.x-1.x-dev

Patch incoming.

Grimreaper opened merge request !3

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented
Assigned: grimreaper » Unassigned
Status: Active » Needs review

@meyerrob done :)

Please test the MR changes.

I have made some quick tests but as CI is broken with D7 I can't trust the test suite.

meyerrob’s picture

meyerrob commented

We reviewed the code and it seems correct. Can you merge the code and release a new dev-release?

  • Grimreaper committed d86d954 on 7.x-1.x 
    Issue #3260323 by Grimreaper, meyerrob: Use user password functions for...
grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented

Thanks for the feedback!

Merged.

I will make a new proper release when getting confirmation that it is ok for you on your website.

meyerrob’s picture

meyerrob commented

I tested the dev release and it worked as expected:

  • "Old" Password (generated with the password generation algorithm from the stable branch): Is accepted by stable und dev branch
  • "New" Password (generated with the user_password generation algorithm from dev branch): Is accepted only by dev branch and should hopefully work in D9 as well

I suggest a new stable release after the D9-migration of the passwords proves that this approach is a valid solution

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented
Status: Needs review » Fixed

Thanks for the feedbacks.

New release done.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.