This Drupal module adds a new command to Drush to check for weak credentials and compare against a password list file (or several).
Dependencies
Drush 6.x
Usage
Enable the module via Drupal backend (admin/modules) or via the drush command drush en user_password_check
Then:
drush user-password-check 5,user3 --uid=2,3 --name=someguy,somegal --mail=billgates@microsoft.com
Check the users with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com
It will print a warning if those users contain the user/password combination user/user. e.g. user3/user3, someguy/someguy, and so on.
To actually block a user with weak credentials:
drush user-password-check admin --block-user
To block the user admin if the password is also admin or its password is in one of the provided files:
drush user-password-check admin --block-user --password-files=file1.txt,file2.txt,...
Alias for this command is upchk
drush upchk admin
Project page:
https://www.drupal.org/sandbox/pable/2534886
To clone the project:
git clone --branch 7.x-1.x http://git.drupal.org/sandbox/pable/2534886.git user_password_check
Paraview results: http://pareview.sh/pareview/httpgitdrupalorgsandboxpable2534886git-7x-1x
Manual reviews of other projects:
| Comment | File | Size | Author |
|---|---|---|---|
| #14 | Codeformats_2537108.patch | 2.76 KB | krknth |
Comments
Comment #1
Arun Murugadoss - Drupal Geeks commentedHi,
Thanks for the work on this module.
. The string translation dt() function is missing in the user_password_check_drush_command() 'description' and arguments array 'users' data. It is recommended to use dt() for string inputs.
. hook_drush_help() is missing from the user_password_check.drush.inc. It is recommended to provide help to the drush command.
Comment #2
PA robot commentedWe are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #3
pablitt commentedThanks for your feedback, Arun!
I've added the drush_help() hook as suggested, I completely forgot about it :)
About the dt() functions, I believe they're not necessary on the places you mention since Drush already adds them internally, e.g. here https://github.com/drush-ops/drush/blob/f9bf23f509499da4b364c748564670ee...
This is the updated result for paraview http://pareview.sh/pareview/httpgitdrupalorgsandboxpable2534886git
Thanks!
Comment #4
pablitt commentedComment #5
devaraj johnson commentedHi
I reviewed you project it looks fine
1) It is recommended to always implement hook_install(). Here you can find an example.
Comment #6
devaraj johnson commentedComment #7
pablitt commentedHi devaraj-johnson, thanks for your feedback! I've added the .install file as suggested.
Thanks!
Comment #8
pablitt commentedComment #9
pablitt commentedComment #10
pablitt commentedComment #11
pablitt commentedComment #12
pablitt commentedComment #13
viswanathan6 commentedHi, few things
Add introduction part your README.txt about your module
Use db_select instead of db_query in user_password_check.drush.inc file
Comment #14
krknth commentedFile : user_password_check.drush.inc
Line 52 :
Please add Function parameters - @param
refer : https://www.drupal.org/node/1354#param
Line 55 :
Please add a comment that what exactly you are trying to get.
Line 57 :
Please add a comment that what exactly you are trying to get.
Line 60 :
Please add a variable reference & pass it to foreach. It will be more readable (If you agree :) )
Line 66 :
I don’t find you where defined these function _drush_user_get_users_from_options_and_arguments().
Line 71 :
Please fix @viswanathan6 comments, I will recommend you to use EntityFieldQuery
Ref : https://www.drupal.org/node/1343708
Line 87 :
You are using drupal core function, Please add a comment that what exactly you are trying to get.
Line 102 :
You are using drupal core function, Please add a comment that what exactly you are trying to get.
Attached patch, Please look into changes
Comment #15
pablitt commentedHello @viswanathan6 and @krknth, thank you so much for your comments, I really appreciate your feedback (and your patch!).
Here's my answer to your comments:
Since this is a Drush command, we want to keep things as low level as the Drush standards itself, please take a look at how the user commands are being implemented in the Drush project. So we're switching to the Drush development context for most of this particular file (
user_password_check.drush.inc).With that being said:
drush_user_password_checkaren't needed in this case because: 1. the function is intended to be called from Drush itself and nowhere else, and 2. the parameters are being parsed from command line (and you can see the reference for the parameters at theuser_password_check_drush_command() hook_drush_command())._drush_user_get_users_from_options_and_arguments(): it's a Drush core function from the user command. Again, the name of the function is pretty self explanatory, but since there's no actual documentation about it (at least nothing I could find), I'll comment a link to the function so it's purpose it's not lost.db_select: again, we're on a Drush context here and we're trying to keep things low level-ish, and if you take a look at the user command implementation you will see that it's actual a matter of compatibility between Drupal versions. And also, because that query is simple and not intended to be modified by anything else, I believe the use ofdb_queryis more suitable here.On the other hand, I've fixed the README.txt file based on @viswanathan6 comments.
Thanks a lot again for your feedbacks!
Cheers!
Comment #16
krknth commentedAgree, Thanks for correcting me :)
Comment #17
rutel95Hello @pablitt.
Manual Review
1)
Please use correctly static query static queries
2) Not working command drush user-password-check @user_name@ write
Missing required options: --password-files, --block-user. See `drush help user-password-check` for information on usage.You have written that in readme.txt command can be used with a single argument.3) Remove the line
in redme.txt because when your project will be full it is not useful
4) Not found functions
Comment #18
mohit_aghera commentedOne more suggestion for implementation:
I am not sure whether you should be using version specific drush commands.
You have dependency on drush 6.x, but now for majority of users might have updated their drush versions to 7.x or 8.x
Because only Drush 8 allows to work with Drupal 8 related sites.
Comment #19
PA robot commentedClosing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).
I'm a robot and this is an automated message from Project Applications Scraper.