passwords are not type-checked [#398902]

Because the regular PHP inequality check is used on passwords, passwords which are numerically equivalent are accepted as the same.

On the edit user page, enter 99999.0 and 99999

The javascript will say they do not match, but submitting the form results in the message "The changes have been saved", and indeed they have.

Discovered on 6.10, confirmed that it exists in 7.x dev and probably all other versions of Drupal.

Presumably the solution is to replace the comparator in form.inc.

Change this:

function password_confirm_validate($form, &$form_state) {
...
    if ($pass1 != $pass2) {
      form_error($form, t('The specified passwords do not match.'));
    }

with this:

function password_confirm_validate($form, &$form_state) {
...
    if (!($pass1 === $pass2)) {
      form_error($form, t('The specified passwords do not match.'));
    }

Comment	File	Size	Author
#10	password_strcmp-D6.patch	639 bytes	alexanderpas
#7	398902_password_confirm_validate_2.patch	2.29 KB	kscheirer
#3	398902_password_confirm_validate.patch	2.29 KB	kscheirer
#2	password_confirm_validate-398902-D6.patch	792 bytes	alexanderpas

Comments

Comment #1

alexanderpas commented 13 March 2009 at 04:47

Assigned:

Unassigned

» alexanderpas

afaics that is indeed the issue there.

Comment #2

alexanderpas commented 13 March 2009 at 05:37

Status:

Active

» Needs work

Status	File	Size
new	password_confirm_validate-398902-D6.patch	792 bytes

code for 6.x and also for 7.x but missing textcase ;)

Pondering on where to place the testcase for 7.x
any insights?

Comment #3

kscheirer

English

Vallejo

commented 4 May 2009 at 22:14

Status:

Needs work

» Needs review

Status	File	Size
new	398902_password_confirm_validate.patch	2.29 KB

good catch!

rerolled patch against HEAD, and added a test case in user.test that attempts to save the type-mismatched passwords.

Comment #4

kscheirer

English

Vallejo

commented 7 May 2009 at 16:47

Title:

Non-matching passwords may be "successfully" submitted if they are numeric

» passwords are not type-checked

better title

Comment #5

lilou commented 7 May 2009 at 22:35

Issue tags:

+Needs backport to D6

Patch look good.

Comment #6

deekayen commented 12 May 2009 at 04:56

Status:

Needs review

» Needs work

I think more accurately what you're looking for is that the string values are the same, not necessarily that the variables are of the same type. How about strcmp()?

if (strcmp($pass1, $pass2) != 0) {

Comment #7

kscheirer

English

Vallejo

commented 20 May 2009 at 05:14

Assigned:	alexanderpas	» kscheirer
Status:	Needs work	» Needs review

Status	File	Size
new	398902_password_confirm_validate_2.patch	2.29 KB

Personally I find !== a little clearer to read, but overall there's no big difference, since this block of code gets so rarely executed. Here ya go with strcmp()...