Current Behaviour

Currently When a user: enters in an incorrect password and clicks on the forgotten password link. This displays a url including the users email address which is passed into Google Analytics.

Google currently restricts the passing of Personally Identifiable information into GA which can result in the Account being blocked and all information deleted.

from: link:
https://support.google.com/analytics/answer/2795983?hl=en

Analytics customers are prohibited from sending personal information to Google.

The Analytics terms of service, which all Analytics customers must adhere to, prohibits sending personally identifiable information (PII) to Analytics (such as names, social security numbers, email addresses, or any similar data), or data that permanently identifies a particular device (such as a mobile phone’s unique device identifier if such an identifier cannot be reset). Your Analytics account could be terminated and your data destroyed if you use any of this information.

Expected Behaviour

- if there is an email being passed as a parameter in the forgotten password display url then this is disregarded and only the page url is sent. Perhaps similarly to how its handled on the search page.

How to repeat

1. Click Login
2. Enter incorrect details
3. Click the forgotten password link that appears
4. Look at the url

CommentFileSizeAuthor
#11 2693595-D7.patch844 bytesTR
#6 ga.PNG27.78 KBsahilsharma011
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

androidbloke created an issue. See original summary.

mobilebloke’s picture

Issue summary: View changes
mobilebloke’s picture

Title: Drupal sending Personally identifiable info to Google Analaytics » Drupal sending Personally identifiable info to Google Analytics
hass’s picture

Version: 7.x-2.1 » 8.x-2.x-dev
Category: Bug report » Feature request

That is the username, not the email. However - not very good. You can exclude the path yourself.

Need to verify again with developer tools if query params really send to google.

hass’s picture

/user/password. Query does not work.

sahilsharma011’s picture

FileSize
27.78 KB

@hass I can confirm this issue.

It can be solved using this. I am not quite sure about the approach it would take to implement this in GA module.

  • hass committed f8d6836 on 8.x-2.x
    Issue #2693595 by hass: Password reset page may send personal data to...

  • hass committed 7346926 on 7.x-2.x
    Issue #2693595 by hass: Password reset page may send personal data to...
hass’s picture

Status: Active » Fixed
mobilebloke’s picture

@hass - how do I see the resolution so I can confirm it?

Thanks for fixing.

TR’s picture

Version: 8.x-2.x-dev » 7.x-2.x-dev
Status: Fixed » Needs review
FileSize
844 bytes

@hass: When you backported this to 7.x-2.x you used the PHP short array syntax, [] instead of array(). This is not allowed in D7 because of it's not supported in the minimum PHP version that D7 uses.

So your 7.x-2.x test are failing (see https://www.drupal.org/pift-ci-job/775410). And anyone else, like me, who has tests dependent upon your module are getting test fails too.

Here's a fix:

hass’s picture

How good that i made this mistake in the tests only. I still wonder why test bot is not failing on d.o. Any idea?

  • hass committed bde441d on 7.x-2.x authored by TR
    Issue #2693595 by TR: Drupal sending Personally identifiable info to...
hass’s picture

Status: Needs review » Fixed
TR’s picture

Status: Fixed » Active

Thank you.

The test bot did fail on the 7.x-2.x-dev branch, see https://www.drupal.org/pift-ci-job/775410, but the failure was only with the PHP 5.3 tests because PHP 5.4 and above allow the short array syntax.

But there is still one more problem - this short array syntax was included in the 7.x-2.4 release, so 7.x-2.4 can't be tested. One of my modules depends on google_analytics, and the testbot only checks out the most recent release, not the -dev version, so my module test still fails.

Can you make a new release, 7.x-2.5 that has this fix?

hass’s picture

You can configure testbot to use latest dev if I‘m not wrong. This may help in future - earlier.

It was really a stupid fault, but just because of this small change... it looks not important enough from my point of view. Per http://php.net/eol.php - php53 is not supported for more than 3 years. You should stop supporting it. Who is still using it? I feal like unsupporting php53 and moving the whole module to short array syntax. I do not feal very motivated about this task, but may accept larger future patches with short array syntax.

What module are you developing that depends?

hass’s picture

Status: Active » Fixed
greggles’s picture

php53 is not supported for more than 3 years. You should stop supporting it. Who is still using it?

PHP53 is still supported by some large linux distributions and they will work on and/or backport security fixes (though the security support is not as strong as more modern versions of php).

In general, I agree the time has come to move to php7.

hass’s picture

Really? What linux distros are out there that still support php 5.3? I thought Debian has longest support... but Debian 6 LTS (php 5.3) is also unsupported and Debian 7 (php 5.4) support ends in mai 2018, too. Ubuntu 12 also has eol april 2017...

TR’s picture

I don't personally use PHP 5.3, but Drupal core does support it and all contributed modules are expected to either support it OR declare a dependency on a higher version of PHP in their .info file.

The testbot tests all D7 code with PHP 5.3, because that's supposed to work.

It's really not about whether PHP 5.3 is currently a good idea, I doubt people are still creating new sites with PHP 5.3, but Drupal 7 has been out for more than 6 years and in reality most people don't do a lot of maintenance on a site once it's up and running (unless of course it breaks...). So I'm sure there are many sites that were set up 6 years ago and are still using PHP 5.3 and have never upgraded, because Drupal doesn't require a higher version.

In my case, my module has a dependencies[] = googleanalytics, so the testbot will download and use the highest stable version of googleanalytics, which is currently 7.x-2.4. This causes the testbot to fail because of the array syntax error.

If you don't want to make a new version with the syntax error fixed, I will change my module to dependencies[] = googleanalytics (!=7.x-2.4).

Oh, and the module with the dependency is uc_googleanalytics, which is bundled with Ubercart (which I maintain). So all the Ubercart 7.x tests have stopped running because of that syntax error in your module's 7.x-2.4 release. I'm just trying to get my tests running again.

greggles’s picture

I didn't realize 2017 was the year a lot of those fell off. Finally :) It looks like Ubuntu 12 has an extra cycle through Extended Security Maintenance for Ubuntu Advantage customers.

And RHEL and therefore CentOS have RHEL6 (PHP 5.3.3) through 2020 on Production Phase 3 and then Extended Life-cycle Support for RHEL6 goes through June 2024. RHEL7 has PHP 5.4.16 through at least June 2024.

All that said...

I don't personally use PHP 5.3, but Drupal core does support it and all contributed modules are expected to either support it OR declare a dependency on a higher version of PHP in their .info file.

I feel like it's getting to be time to declare later versions. 5.5 is a good step up. 7.0 is a great step forward.

The testbot tests all D7 code with PHP 5.3, because that's supposed to work.

The testbot can be configured to run with 5.3, but it can also be configured to run later versions of PHP for Drupal 7 modules and I think that's a reasonable thing to do.

hass’s picture

Marking ga v2.4 as unsupported by adding this dependency to uc is for sure incorrect. The module is compatible. You may add test_dependency[] to use latest dev for tests.

Only a minor test has a failure on php53.

Per https://access.redhat.com/security/updates/backporting there is no longer php53 support for redhat 6. The last php53 was in redhat 6.3 and per https://access.redhat.com/support/policy/updates/errata support ended in June 30, 2014. If you do not run latest redhat 6.7 you will not have support until December 31, 2018. just because redhat 6 is supported until 2020 does not mean php53 get any fix since 2014... so redhat is also out... the list get‘s smaller by reading the details... :-)

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.