If
1. any module implementing user_update hook call user_save (in my case ldap_user.module) and
2. user is changed password
then "hash of hash of pass" is written into user table.
Don’t miss
unset($edit['pass']);
before
user_module_invoke('update', $edit, $account, $category);
in user_save() ?
And/or test for category 'account' before hashing of password?
Or missing documentation about denied calling user_save in user_update hook?
My opinion is: another subsystems don´t need to know clear password.
My configuration:
Win7, Apache 2.2, PHP 5.3.9, Drupal 7.16 with LDAP 7.x-2.x-dev
Comments