Recently we got a new version of user_pass_rehash() with some "backward compatible" code that attempts to read a user identifier using the last login timestamp.
Unfortunately, the login parameter is checked with a string:
$result = db_query_range("SELECT uid FROM {users} WHERE pass = '%s' AND login = '%s' AND uid > 0", $password, $login, 0, 2);
Since that field is an integer, the correct code is:
$result = db_query_range("SELECT uid FROM {users} WHERE pass = '%s' AND login = %d AND uid > 0", $password, $login, 0, 2);
Without that, this fix is totally useless for PostgreSQL users (and it actually generate errors in their logs.)
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | incorrecct_datatype_check-7.patch | 659 bytes | joyceg |
| #3 | incorrecct_datatype_check-3.patch | 661 bytes | joyceg |
Comments
Comment #2
joyceg commentedComment #3
joyceg commentedComment #4
joyceg commentedComment #5
AlexisWilke commentedI do not know whether Drupal test servers offer a test with PostgreSQL, if not, you cannot be sure that your fix will pass...
Anyway, it is wrong since you kept the quotes. My sample is correct:
... login = %d ...Comment #6
joyceg commentedComment #7
joyceg commentedComment #8
joyceg commentedComment #9
AlexisWilke commentedOkay, that works.
Note that if you want to work on patches for PostgreSQL then you should have a test system with PostgreSQL running on it. That way you can make sure it goes through as expected...