Hi All,

Im exposing the PUT user endpoint to update user data. since uuid_services module is enabled, then the user endpoint is overriden by this module.

Here is the request
Endpoint: {{Server}}/api/user/{{uuid}}.json

Body:
{
"uid":"1",
"mail":"some@mail.com",
"pass":"test",
"uuid": "{{uuid}}"
}

The service returns

{
"uid": "1",
"mail": "some@mail.com",
"pass": "test",
"uuid": "{{uuid}}",
"uuid_services": true,
"name": "some_name,
"picture": null
}

and looking in the database, the password is not encrypted and saved as is in the database. Yes i'm trying to update the user password via services... but it should be encrypted by the save method right?

thanks,
Carlos

Comments

tengoku created an issue. See original summary.

  • skwashd committed 35153a2 on 7.x-1.x
    Issue #2724323 by skwashd: Ensure passwords are always encrypted
    
skwashd’s picture

@tengoku thanks for the bug report. UUID Services is generally used to deploy entities, including users, from one Drupal site to another. In this case the password is already hashed. When UUID services is used more like services is used traditionally we can't assume that the password has already been hashed.

skwashd’s picture

Status: Active » Fixed

I have committed a fix. I hope to cut a new release in the coming days.

joseph.olstad’s picture

Nice work, voting for 7.x-1.0 :)

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.