Password encrypted twice if revisioning module is enabled [#1559162]

When saving a password, the password is saved correctly in the database, for the first time or for the first change.

However, if moderation is enabled (as part of the revisioning module) to publish the new revision, the password is saved again with encryption applied twice. i.e. the step where moderators select publish this and then press the publish button.

The workaround is to untick 'New revision in draft, pending moderation' on the node edit form, but it would be nice if the modules could work together.

Comments

Comment #1

luthien commented 9 July 2012 at 23:40

I'm having the same problem, your solution works but as soon as a moderator updates the workflow status to Live, the pw failed.

Comment #2

bradspry commented 6 February 2013 at 04:20

Priority:

Normal

» Critical

I'm having a very similar problem, your report clued me in...

Revisions are enabled on my content-type, save new revision every time. I am not using moderation.

What I have observed happening on new node creation, with password protection enabled:

1. I set password to 'brad'
2. resulting hash of the set password is rehashed and saved in database

Correct sha-1 hash for 'brad':
9233b6f5388d6867a2a7be14d8b4ba53c86cfde2

Correct sha-1 hash rehashed:
9fbbdf964200e6d49297bf5272349638b037cd2c

The original password's hash is being rehashed and stored in the database on initial node creation...

I'm reviewing the module's code in an effort to find where this might be happening.

UPDATE: I've disabled revisions on my content-type and the problem still persists. That should effectively eliminate revisions from the suspect list on my particular permutation of the issue...

UPDATE2: MySQL debug of new node creation shows initial sql INSERT with correct sha-1 hash followed immediately by sql UPDATE call containing incorrect hash... See above examples for comparison. The sql UPDATE call should not be happening on new node creation...

257 Query INSERT INTO protected_nodes (protected_node_is_protected, protected_node_passwd, protected_node_show_title, nid, protected_node_hint) VALUES (1, '9233b6f5388d6867a2a7be14d8b4ba53c86cfde2', 0, nid, '')

257 Query UPDATE protected_nodes SET protected_node_is_protected = 1, protected_node_passwd = '9fbbdf964200e6d49297bf5272349638b037cd2c', protected_node_show_title = 0, protected_node_hint = '' WHERE nid = nid

UPDATE3 - PROPOSED FIX PLEASE TEST:

Line 655

Before:
$node->protected_node_passwd = sha1($node->protected_node_passwd);

After:
$node->protected_node_passwd = $node->protected_node_passwd;

Works perfectly in my testing. Password is SHA-1'ed correctly on initial node creation, and SHA-1'ed correctly on subsequent saves.