user_service always returns a positive result

Gonna have a look at this soon.

Scott

This issue should be resolved in 6 as a user object isn't always returned by user_authenicate.

If load user fails the value of the user object isn't over written. I think this issue is specific to services so not sure how we will get this change in
and I'm know I haven't done enough testing for 5 to submit a patch.

Current

if ($account = user_load(array('name' => $name, 'pass' => $pass, 'status' => 1))) {
    $user = $account;
    return $user;
  }

Possible fix

if ($account = user_load(array('name' => $name, 'pass' => $pass, 'status' => 1))) {
    $user = $account;
    return $user;
  }
  else{
  	$user = false;
  }
 

function under 6

function user_authenticate($form_values = array()) {
  global $user;

  // Name and pass keys are required.
  if (!empty($form_values['name']) && !empty($form_values['pass']) &&
      $account = user_load(array('name' => $form_values['name'], 'pass' => trim($form_values['pass']), 'status' => 1))) {
    $user = $account;
    user_authenticate_finalize($form_values);
    return $user;
  }
}

How should we proceed with one?

Hi, In drupal 5.6 i am able to login if i am a authenticated user if i enter a wrong password i am getting wrong user name and password. After entering a wrong password if i try to enter the authenticated username i am not able to log in an i am automatically loged off from drupal hence i am not able to login if i use the authenticated user name and password. I am using flex as the front end.

if ($account = user_load(array('name' => $name, 'pass' => $pass, 'status' => 1))) {
    $user = $account;
    return $user;
  }
  else{
      $user = false;
  }

I'll test on drupal 6 and see if this is resolved if it is then my view is that we can park the issue for D5 for now. This needs to work to get services into core. I'll test over the next couple of days.

With Flash/Flex, browser cookies are used, so if they're logged into the browser already, they're logged into Flash/Flex. The proper way to handle this is to do a system.connect at initial load of the Flash/Flex app, which passes back either a logged in or anonymous user object.

I do think though, that this behavior of just letting someone through regardless if they're already logged in is wrong, so I've commit a fix to both D5 and D6. The fix throws a fault if you try make a login/logout request and the user is already logged in/out.

If anyone has a different idea of how this should work, do speak up.

D5 #127128
D6 #127129

Scott