Because the global user object is not fully loaded (e.g. user_load()) we are missing important properties that modules like Realname that implement hook_format_username_alter() may required.

CommentFileSizeAuthor
#8 976092-format-username-fixes-D7.patch5.33 KBdave reid
#2 976092-format-username-fixes-D7.patch5.33 KBdave reid
#1 976092-format-username-fixes-D7.patch3.33 KBdave reid

Comments

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Active » Needs review
Issue tags: +realname, +format_username
StatusFileSize
new 976092-format-username-fixes-D7.patch3.33 KB

Also fixes some use where we try to pass in $node, which is just wrong, wrong, wrong.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
StatusFileSize
new 976092-format-username-fixes-D7.patch5.33 KB

Found more.

BenK’s picture

BenK commented

Subscribing

moshe weitzman’s picture

moshe weitzman commented

I suppose contrib supposed to start loading current user all over the place too? This is ugly. Not sure how to proceed. I wanted #361471-12: Global $user object should be a complete entity

joachim’s picture

joachim commented

Either way, isn't this going to make showing pages like /node and /blog a fair bit more expensive?

I do agree that passing the $node is very wrong!

dries’s picture

dries commented
Status: Needs review » Needs work

I don't think this is the proper solution. If we want to do this, we should do it differently IMO. That or the Realname module should do a user_load().

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Needs work » Needs review

Except the problem is realname doesn't know *when* it should have to do user_load(). If you can answer me that with code, then I'm fine with this. But we still shouldn't be passing in $node objects to format_username(). That's just wrong.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
StatusFileSize
new 976092-format-username-fixes-D7.patch5.33 KB

Wow, this also fixes potential XSS because format_username should not be used with !placeholders in t(). It's supposed to be check_plain()'d.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

Another reason why its better to fix it this way rather than "let contrib deal with core's bugs" is because since $account is an object and by default PHP objects are passed by reference, if a modules does $account = user_load($account->uid); in hook_format_username_alter(), it's now overwritten what is really the $node object that's passed in before the patch above is applied.

mgifford’s picture

mgifford
he/him
Primary language English
commented
Assigned: dave reid » Unassigned
Issue summary: View changes
Status: Needs review » Needs work

Patch no longer applies.

Status: Needs work » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.