Skip to content
Snippets Groups Projects
Commit cc00d6ec authored by Mike Barkas's avatar Mike Barkas Committed by Matt Vance
Browse files

Issue #2483015 by mikebarkas: hook_requirements usage breaks installer

parent 389f42b4
No related branches found
No related tags found
No related merge requests found
......@@ -12,51 +12,56 @@
*/
function username_enumeration_prevention_requirements($phase) {
$requirements = array();
// Ensure translations don't break during installation.
$t = get_t();
$username_enumeration_prevention_roles = user_roles(FALSE, 'access user profiles');
if (isset($username_enumeration_prevention_roles[1]) && $username_enumeration_prevention_roles[1] == "anonymous user") {
$value = t('WARNING! Anonymous users have permission to access user
profiles.');
$severity = REQUIREMENT_WARNING;
}
else {
$value = t('Anonymous users do not have permission to access user
profiles.');
}
$requirements['username_enumeration_prevention_via_permissions'] = array(
'title' => t('Username enumeration prevention'),
'value' => $value,
'description' => t('Granting anonymous users permission to access user
profiles poses a security risk because it allows users who are not logged
into the site to obtain usernames via callbacks. More information is
available in the module README or on the !url.', array('!url' =>
l(t('project page'),
'http://drupal.org/project/username_enumeration_prevention'))),
'severity' => isset($severity) ? $severity : REQUIREMENT_OK,
);
if (module_exists('pathauto') && module_exists('globalredirect')) {
$globalredirect_settings = _globalredirect_get_settings();
if (strstr(variable_get('pathauto_user_pattern', 'users/[user:name]'), '[user:name]') && !$globalredirect_settings['menu_check']) {
$value = t('WARNING! Current Pathauto and Global Redirect settings may
expose usernames.');
// Only in the Runtime $phase environment.
if ($phase == 'runtime') {
$username_enumeration_prevention_roles = user_roles(FALSE, 'access user profiles');
if (isset($username_enumeration_prevention_roles[1]) && $username_enumeration_prevention_roles[1] == "anonymous user") {
$value = $t('WARNING! Anonymous users have permission to access user
profiles.');
$severity = REQUIREMENT_WARNING;
} else {
$value = t('Pathauto and Global Redirect settings have been changed from
the defaults that can expose username.');
}
$requirements['username_enumeration_prevention_via_redirects'] = array(
'title' => t('Username enumeration prevention'),
else {
$value = $t('Anonymous users do not have permission to access user
profiles.');
}
$requirements['username_enumeration_prevention_via_permissions'] = array(
'title' => $t('Username enumeration prevention'),
'value' => $value,
'description' => t("Pathauto's default user paths, along with Global
Redirect's default Menu Access Checking disabled combine to create
redirects with no access checking. More information is available in the
!url.", array('!url' => l(t('Global Redirect issue queue'),
'http://drupal.org/node/782476'))),
'description' => $t('Granting anonymous users permission to access user
profiles poses a security risk because it allows users who are not logged
into the site to obtain usernames via callbacks. More information is
available in the module README or on the !url.', array('!url' =>
l($t('project page'),
'http://drupal.org/project/username_enumeration_prevention'))),
'severity' => isset($severity) ? $severity : REQUIREMENT_OK,
);
}
if (module_exists('pathauto') && module_exists('globalredirect')) {
$globalredirect_settings = _globalredirect_get_settings();
if (strstr(variable_get('pathauto_user_pattern', 'users/[user:name]'), '[user:name]') && !$globalredirect_settings['menu_check']) {
$value = $t('WARNING! Current Pathauto and Global Redirect settings may
expose usernames.');
$severity = REQUIREMENT_WARNING;
}
else {
$value = $t('Pathauto and Global Redirect settings have been changed from
the defaults that can expose username.');
}
$requirements['username_enumeration_prevention_via_redirects'] = array(
'title' => $t('Username enumeration prevention'),
'value' => $value,
'description' => $t("Pathauto's default user paths, along with Global
Redirect's default Menu Access Checking disabled combine to create
redirects with no access checking. More information is available in the
!url.", array('!url' => l($t('Global Redirect issue queue'),
'http://drupal.org/node/782476'))),
'severity' => isset($severity) ? $severity : REQUIREMENT_OK,
);
}
}
return $requirements;
}
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment