This Drupal module adds a new command to Drush to check for weak credentials and compare against a password list file (or several).

Dependencies

Drush 6.x

Usage

Enable the module via Drupal backend (admin/modules) or via the drush command drush en user_password_check

Then:

drush user-password-check 5,user3 --uid=2,3 --name=someguy,somegal  --mail=billgates@microsoft.com

Check the users with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com

It will print a warning if those users contain the user/password combination user/user. e.g. user3/user3, someguy/someguy, and so on.

To actually block a user with weak credentials:

drush user-password-check admin --block-user

To block the user admin if the password is also admin or its password is in one of the provided files:

drush user-password-check admin --block-user --password-files=file1.txt,file2.txt,...

Alias for this command is upchk

drush upchk admin

Project page:
https://www.drupal.org/sandbox/pable/2534886

To clone the project:

git clone --branch 7.x-1.x http://git.drupal.org/sandbox/pable/2534886.git user_password_check

Paraview results: http://pareview.sh/pareview/httpgitdrupalorgsandboxpable2534886git-7x-1x

Manual reviews of other projects:

CommentFileSizeAuthor
#14 Codeformats_2537108.patch2.76 KBkrknth

Comments

Arun Murugadoss - Drupal Geeks’s picture

Hi,

Thanks for the work on this module.

. The string translation dt() function is missing in the user_password_check_drush_command() 'description' and arguments array 'users' data. It is recommended to use dt() for string inputs.

. hook_drush_help() is missing from the user_password_check.drush.inc. It is recommended to provide help to the drush command.

PA robot’s picture

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

pablitt’s picture

Thanks for your feedback, Arun!

I've added the drush_help() hook as suggested, I completely forgot about it :)

About the dt() functions, I believe they're not necessary on the places you mention since Drush already adds them internally, e.g. here https://github.com/drush-ops/drush/blob/f9bf23f509499da4b364c748564670ee...

This is the updated result for paraview http://pareview.sh/pareview/httpgitdrupalorgsandboxpable2534886git

Thanks!

pablitt’s picture

devaraj johnson’s picture

Hi
I reviewed you project it looks fine

1) It is recommended to always implement hook_install(). Here you can find an example.

devaraj johnson’s picture

Status: Needs review » Needs work
pablitt’s picture

Hi devaraj-johnson, thanks for your feedback! I've added the .install file as suggested.

Thanks!

pablitt’s picture

Status: Needs work » Needs review
pablitt’s picture

Issue summary: View changes
pablitt’s picture

Issue summary: View changes
pablitt’s picture

Issue summary: View changes
Issue tags: +PAreview: review bonus
pablitt’s picture

Issue summary: View changes
viswanathan6’s picture

Hi, few things

Add introduction part your README.txt about your module
Use db_select instead of db_query in user_password_check.drush.inc file

krknth’s picture

StatusFileSize
new2.76 KB

File : user_password_check.drush.inc
Line 52 :

Please add Function parameters - @param

/**
 * Check user password.
 * @param $users
 *   List of user objects
 */

refer : https://www.drupal.org/node/1354#param

Line 55 :

Please add a comment that what exactly you are trying to get.

Line 57 :

Please add a comment that what exactly you are trying to get.

Line 60 :

Please add a variable reference & pass it to foreach. It will be more readable (If you agree :) )

Line 66 :

I don’t find you where defined these function _drush_user_get_users_from_options_and_arguments().

Line 71 :

Please fix @viswanathan6 comments, I will recommend you to use EntityFieldQuery
Ref : https://www.drupal.org/node/1343708

Line 87 :

You are using drupal core function, Please add a comment that what exactly you are trying to get.

Line 102 :

You are using drupal core function, Please add a comment that what exactly you are trying to get.

Attached patch, Please look into changes

pablitt’s picture

Hello @viswanathan6 and @krknth, thank you so much for your comments, I really appreciate your feedback (and your patch!).

Here's my answer to your comments:

Since this is a Drush command, we want to keep things as low level as the Drush standards itself, please take a look at how the user commands are being implemented in the Drush project. So we're switching to the Drush development context for most of this particular file (user_password_check.drush.inc).

With that being said:

  • The docblocks for drush_user_password_check aren't needed in this case because: 1. the function is intended to be called from Drush itself and nowhere else, and 2. the parameters are being parsed from command line (and you can see the reference for the parameters at the user_password_check_drush_command() hook_drush_command()).
  • Comments on lines 55, 57, 87, and 102 aren't needed as well since the the functions are self explanatory, there's no need to be redundant since there's no cryptic stuff going on on these lines. Also, there's even less need for the Drupal core ones (e.g. we're are not explaining db_select or db_query ;) ).
  • about _drush_user_get_users_from_options_and_arguments(): it's a Drush core function from the user command. Again, the name of the function is pretty self explanatory, but since there's no actual documentation about it (at least nothing I could find), I'll comment a link to the function so it's purpose it's not lost.
  • About db_select: again, we're on a Drush context here and we're trying to keep things low level-ish, and if you take a look at the user command implementation you will see that it's actual a matter of compatibility between Drupal versions. And also, because that query is simple and not intended to be modified by anything else, I believe the use of db_query is more suitable here.

On the other hand, I've fixed the README.txt file based on @viswanathan6 comments.

Thanks a lot again for your feedbacks!

Cheers!

krknth’s picture

Agree, Thanks for correcting me :)

rutel95’s picture

Status: Needs review » Needs work
Issue tags: -PAreview: review bonus

Hello @pablitt.
Manual Review
1)

$user_list = db_query("SELECT u.uid, u.name, u.pass 
      FROM {users} u 
      LEFT JOIN {authmap} a ON u.uid = a.uid
      WHERE u.uid > 0
      AND u.status = 1
      AND a.uid IS NULL")
      ->fetchAll();

Please use correctly static query static queries
2) Not working command drush user-password-check @user_name@ write Missing required options: --password-files, --block-user. See `drush help user-password-check` for information on usage. You have written that in readme.txt command can be used with a single argument.
3) Remove the line

$ git clone --branch 7.x-1.x http://git.drupal.org/sandbox/pable/2534886.git 
      user_password_check

in redme.txt because when your project will be full it is not useful
4) Not found functions

_drush_user_get_users_from_options_and_arguments($users);
drush_log();
drush_get_option();
dt();
mohit_aghera’s picture

One more suggestion for implementation:
I am not sure whether you should be using version specific drush commands.
You have dependency on drush 6.x, but now for majority of users might have updated their drush versions to 7.x or 8.x
Because only Drush 8 allows to work with Drupal 8 related sites.

PA robot’s picture

Status: Needs work » Closed (won't fix)

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.