In function password_policy_constraint_history_validate($password, $constraint, $account) the $account object is modified which causes some problem when we use the password_policy_validate to custom forms. In my case I am using the Password Reset Landing Page (PRLP) module and I am adding password_policy_password_validate() to user_reset_form and since the password_policy_constraint_history_validate alters the $account object, it causes the PRLP module to fail. So I patched the code as follow to restore the original password.
function password_policy_constraint_history_validate($password, $constraint, $account) {
require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
$old_passwords = _password_policy_constraint_history_old_passwords($constraint, $account->uid);
// Storing org pass
$org_pass = $account->pass;</strong>
foreach ($old_passwords as $pw) {
$account->pass = $pw;
if (user_check_password($password, $account)) {
//Restoring org pass
account->pass = $org_pass;
return FALSE;
}
}
//Restoring org pass
$account->pass = $org_pass;
return TRUE;
}
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | password_policy-7.x-1.x-avoid_changing_account_in_history_constraint-2490548-4.patch | 887 bytes | aohrvetpv |
Comments
Comment #1
msmani commentedComment #2
msmani commentedComment #3
msmani commentedComment #4
aohrvetpv commentedThanks for the problem report and patch. I view this as a bug.
It might be better to just create a temporary account object that can be modified. It adds only one line of code versus three, and avoids the duplicate
$account->pass = $org_pass;lines. Any problems with this patch?Comment #8
aohrvetpv commentedForgot to push a commit before posting patch.
Comment #10
aohrvetpv commentedIt seems like constraint validation should not even be able to modify the account object. Maybe we should be duplicating the object or changing it to an array before passing it to
validate(). Not sure of the performance implications of either of those changes.Comment #12
aohrvetpv commentedCommitted #4 because it seems like a straightforward fix, and there has been four weeks of opportunity for review/testing.
Comment #13
aohrvetpv commentedComment #14
aohrvetpv commentedConfirmed 6.x-1.x does not have this bug.