There are currently no way, hook_form_alter() aside, to have the PL checkbox checked per default. I needed this functionality in a project and thought someone else might as well, so I rolled a patch. Because the feature could jeopardize the security of your users, non-savvy ones at public computers for example, I included a warning about this as well.

CommentFileSizeAuthor
persistent_login-checked_default.patch1.83 KBtobiassjosten

Comments

markus_petrux’s picture

markus_petrux commented
Status: Active » Closed (works as designed)

Sorry, I should say "by design" because of security concerns. The "remember me" option should be explicitly decided in real-time. You cannot guess when users connecting to the site are doing so from a secure environment where they would be safe to use this option.

If you need this feature, as you already noticed, you can implement your own custom hook_form_alter().

tobiassjosten’s picture

tobiassjosten commented

I agree that it should be explicitly decided by the user. However, I strongly feel that this is a decision best left to the site administrator/developer. If someone really wants this feature (a client I'm working with does, for example) then why should we deliberately make it harder to implement it? Being forced to create a site custom module just for the sake of this feels like a hack, especially when the option is to add the feature along with sensible defaults (disabled) and a sufficient warning message.

Could you please reconsider your position on this?

markus_petrux’s picture

markus_petrux commented

Re: "this is a decision best left to the site administrator/developer"

Nope. The admin/dev does not know if the users are going to log in from a secure environment or not. Even if it was an intranet, there may be shared workstations.

In fact, I think you should advice your client this is a bad decission. Teach her/him about XSS and CRSF. It's a security risk that users need to decide based on there own risk to use a PL or not.

And if your client still wants to take that road, then you can do it using hook_form_alter(), but I don't wish to open this risk to others. That's why I preferred to tell here "by design".