Problem/Motivation

The validation handler added to the user account forms contains the following code.

if (\Drupal::currentUser()->hasPermission('bypass user restriction rules')) {
  return;
}

// During login, the current user will not be logged in, so check first and
// load the account used to log in.
if (!\Drupal::currentUser()->isAuthenticated()) {
  $user = user_load_by_name($form_state->getValue('name'));
  if ($user && $user->hasPermission('bypass user restriction rules')) {
    return;
  }
}

Calling user_load_by_name() is not necessary because:

  • In the login form, UserLoginForm::validateAuthentication() already stores the user ID using the following code
          // We are not limited by flood control, so try to authenticate.
          // Store the user ID in form state as a flag for self::validateFinal().
          if ($this->userAuth instanceof UserAuthenticationInterface) {
            $form_state->set('uid', $this->userAuth
              ->authenticateAccount($account, $password) ? $account->id() : FALSE);
          }
          else {
            $uid = $this->userAuth
              ->authenticate($form_state->getValue('name'), $password);
            $form_state->set('uid', $uid);
          }
        }
        elseif (!$this->userAuth instanceof UserAuthenticationInterface) {
          $uid = $this->userAuth
            ->authenticate($form_state->getValue('name'), $password);
          $form_state->set('uid', $uid);
        }
  • In the registration form, when visitors create their own account, the account has not been yet created when the validation handler is invoked; loading it would fail

Proposed resolution

  • In the login form, load the account using the user ID stored by the previously invoked validation handler
  • In the registration form, do not load the account
Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

avpaderno created an issue. See original summary.

avpaderno’s picture

Issue summary: View changes

  • avpaderno committed 40ee1ed4 on 3.0.x
    Issue #3547782: Calling user_load_by_name() is not necessary
    
avpaderno’s picture

Status: Active » Needs review
avpaderno’s picture

Version: 3.0.x-dev » 2.0.x-dev

avpaderno’s picture

Status: Needs review » Reviewed & tested by the community

  • avpaderno committed 912cac27 on 2.0.x
    Issue #3547782: Calling user_load_by_name() is not necessary
    
avpaderno’s picture

Status: Reviewed & tested by the community » Fixed

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.