Importing hashed passwords on Drupal 10.1 is broken

Problem/Motivation

Drupal 10.1 changed the password hashing - which breaks importing hashed passwords with Feeds.

See https://www.drupal.org/node/3322420

To keep supporting the import of MD5 or sha512 hashed passwords, the new core module Password Compatibility needs to be enabled.

Steps to reproduce

• Install Drupal 10.1
• Try to import a user with either a MD5 or sha512 hashed password
• Try to login as the imported user.

Login will fail.

Proposed resolution

When on Drupal 10.1, require the Password Compatibility module (phpass) for the options "md5" and "sha512". When the module is not enabled, disable these options in the UI and add a message that the Password Compatibility module is required in order to import hashed passwords.

When on < Drupal 10.1, leave everything working as now. No UI changes in this case.

Remaining tasks

• Review the proposed solution
• Test the mapping UI with both Drupal 10.1 and before Drupal 10.1.

Testing

Test the following scenario's:

Drupal 10.1

1. Do a clean install of Drupal 10.1.
2. Enable Feeds.
3. Create a feed type, select the user processor and save.
4. Add a mapping target to "Password" and save mappings.
5. Click on target configuration for this target. Options "MD5" and "SHA512" should be greyed out. Do you understand why?
6. Resolve the issue to make the options "MD5" and "SHA512" active.
7. Go back to the mapping screen, configure the target "Password" and confirm that options "MD5" and "SHA512" are now available.

Drupal 10.0 (or Drupal 9.5)

1. For this test you may either use a clean install or an existing install.
2. Enable Feeds.
3. Create a feed type, select the user processor and save.
4. Add a mapping target to "Password".
5. Click on target configuration for this target. Confirm all options are available.
6. Select either "MD5" or "SHA512".
7. Save mappings.
8. Upgrade to Drupal 10.1 and run database updates.
9. Uninstall the module "Password Compatibility".
10. Go back to mapping screen. A message should appear that there's an issue with the Password target.

User interface changes

When on Drupal 10.1 and when using the FeedsTarget plugin "password", a warning message gets displayed when the Password Compatibility module is not enabled on the mapping page.

In the summary column:

On the target configuration:

API changes

None.

Data model changes

None.