If

    1. any module implementing user_update hook call user_save (in my case ldap_user.module) and
    2. user is changed password

then "hash of hash of pass" is written into user table.

Don’t miss
unset($edit['pass']);
before
user_module_invoke('update', $edit, $account, $category);
in user_save() ?

And/or test for category 'account' before hashing of password?
Or missing documentation about denied calling user_save in user_update hook?

My opinion is: another subsystems don´t need to know clear password.
My configuration:
Win7, Apache 2.2, PHP 5.3.9, Drupal 7.16 with LDAP 7.x-2.x-dev

Comments

Version: 7.16 » 7.x-dev

Core issues are now filed against the dev versions where changes will be made. Document the specific release you are using in your issue comment. More information about choosing a version.

Status: Active » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.