Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
username_enumeration_prevention
Manage
Activity
Members
Labels
Plan
Wiki
Custom issue tracker
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Model registry
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
project
username_enumeration_prevention
Commits
cc00d6ec
Commit
cc00d6ec
authored
9 years ago
by
Mike Barkas
Committed by
Matt Vance
9 years ago
Browse files
Options
Downloads
Patches
Plain Diff
Issue
#2483015
by mikebarkas: hook_requirements usage breaks installer
parent
389f42b4
No related branches found
No related tags found
No related merge requests found
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
username_enumeration_prevention.install
+44
-39
44 additions, 39 deletions
username_enumeration_prevention.install
with
44 additions
and
39 deletions
username_enumeration_prevention.install
+
44
−
39
View file @
cc00d6ec
...
...
@@ -12,51 +12,56 @@
*/
function
username_enumeration_prevention_requirements
(
$phase
)
{
$requirements
=
array
();
// Ensure translations don't break during installation.
$t
=
get_t
();
$username_enumeration_prevention_roles
=
user_roles
(
FALSE
,
'access user profiles'
);
if
(
isset
(
$username_enumeration_prevention_roles
[
1
])
&&
$username_enumeration_prevention_roles
[
1
]
==
"anonymous user"
)
{
$value
=
t
(
'WARNING! Anonymous users have permission to access user
profiles.'
);
$severity
=
REQUIREMENT_WARNING
;
}
else
{
$value
=
t
(
'Anonymous users do not have permission to access user
profiles.'
);
}
$requirements
[
'username_enumeration_prevention_via_permissions'
]
=
array
(
'title'
=>
t
(
'Username enumeration prevention'
),
'value'
=>
$value
,
'description'
=>
t
(
'Granting anonymous users permission to access user
profiles poses a security risk because it allows users who are not logged
into the site to obtain usernames via callbacks. More information is
available in the module README or on the !url.'
,
array
(
'!url'
=>
l
(
t
(
'project page'
),
'http://drupal.org/project/username_enumeration_prevention'
))),
'severity'
=>
isset
(
$severity
)
?
$severity
:
REQUIREMENT_OK
,
);
if
(
module_exists
(
'pathauto'
)
&&
module_exists
(
'globalredirect'
))
{
$globalredirect_settings
=
_globalredirect_get_settings
();
if
(
strstr
(
variable_get
(
'pathauto_user_pattern'
,
'users/[user:name]'
),
'[user:name]'
)
&&
!
$globalredirect_settings
[
'menu_check'
])
{
$value
=
t
(
'WARNING! Current Pathauto and Global Redirect settings may
expose usernames.'
);
// Only in the Runtime $phase environment.
if
(
$phase
==
'runtime'
)
{
$username_enumeration_prevention_roles
=
user_roles
(
FALSE
,
'access user profiles'
);
if
(
isset
(
$username_enumeration_prevention_roles
[
1
])
&&
$username_enumeration_prevention_roles
[
1
]
==
"anonymous user"
)
{
$value
=
$t
(
'WARNING! Anonymous users have permission to access user
profiles.'
);
$severity
=
REQUIREMENT_WARNING
;
}
else
{
$value
=
t
(
'Pathauto and Global Redirect settings have been changed from
the defaults that can expose username.'
);
}
$requirements
[
'username_enumeration_prevention_via_redirects'
]
=
array
(
'title'
=>
t
(
'Username enumeration prevention'
),
else
{
$value
=
$t
(
'Anonymous users do not have permission to access user
profiles.'
);
}
$requirements
[
'username_enumeration_prevention_via_permissions'
]
=
array
(
'title'
=>
$t
(
'Username enumeration prevention'
),
'value'
=>
$value
,
'description'
=>
t
(
"Pathauto's default user paths, along with Global
Redirect's default Menu Access Checking disabled combine to create
redirects with no access checking. More information is available in the
!url."
,
array
(
'!url'
=>
l
(
t
(
'Global Redirect issue queue'
),
'http://drupal.org/node/782476'
))),
'description'
=>
$t
(
'Granting anonymous users permission to access user
profiles poses a security risk because it allows users who are not logged
into the site to obtain usernames via callbacks. More information is
available in the module README or on the !url.'
,
array
(
'!url'
=>
l
(
$t
(
'project page'
),
'http://drupal.org/project/username_enumeration_prevention'
))),
'severity'
=>
isset
(
$severity
)
?
$severity
:
REQUIREMENT_OK
,
);
}
if
(
module_exists
(
'pathauto'
)
&&
module_exists
(
'globalredirect'
))
{
$globalredirect_settings
=
_globalredirect_get_settings
();
if
(
strstr
(
variable_get
(
'pathauto_user_pattern'
,
'users/[user:name]'
),
'[user:name]'
)
&&
!
$globalredirect_settings
[
'menu_check'
])
{
$value
=
$t
(
'WARNING! Current Pathauto and Global Redirect settings may
expose usernames.'
);
$severity
=
REQUIREMENT_WARNING
;
}
else
{
$value
=
$t
(
'Pathauto and Global Redirect settings have been changed from
the defaults that can expose username.'
);
}
$requirements
[
'username_enumeration_prevention_via_redirects'
]
=
array
(
'title'
=>
$t
(
'Username enumeration prevention'
),
'value'
=>
$value
,
'description'
=>
$t
(
"Pathauto's default user paths, along with Global
Redirect's default Menu Access Checking disabled combine to create
redirects with no access checking. More information is available in the
!url."
,
array
(
'!url'
=>
l
(
$t
(
'Global Redirect issue queue'
),
'http://drupal.org/node/782476'
))),
'severity'
=>
isset
(
$severity
)
?
$severity
:
REQUIREMENT_OK
,
);
}
}
return
$requirements
;
}
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment