testing for the existence of username in pam credentials before using

git-svn-id: http://code.elgg.org/elgg/trunk@7907 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/engine/lib/sessions.php b/engine/lib/sessions.php
index 4cdc9bcce34cd0252662d2904a7fc9f3562890d5..eb47f4eb5a7be0542a6aa65d8ec503f0c4220070 100644 (file)
--- a/engine/lib/sessions.php
+++ b/engine/lib/sessions.php
@@ -182,7 +182,7 @@ function authenticate($username, $password) {
  */
 function pam_auth_userpass($credentials = NULL) {
 
-       if (!is_array($credentials) && (!$credentials['username']) && (!$credentials['password'])) {
+       if (!is_array($credentials) || !isset($credentials['username']) || !isset($credentials['password'])) {
                return false;
        }
 

diff --git a/engine/lib/web_services.php b/engine/lib/web_services.php
index e529711e1154822353fd2c73d095c82e6e05fb9b..33f413c5cf1d8fce351581e819e4999e01575631 100644 (file)
--- a/engine/lib/web_services.php
+++ b/engine/lib/web_services.php
@@ -177,7 +177,7 @@ function authenticate_method($method) {
        }
 
        $user_pam = new ElggPAM('user');
-       $user_auth_result = $user_pam->authenticate();
+       $user_auth_result = $user_pam->authenticate(array());
 
        // check if user authentication is required
        if ($API_METHODS[$method]["require_user_auth"] == true) {

diff --git a/mod/uservalidationbyemail/start.php b/mod/uservalidationbyemail/start.php
index 9d4233f379af32bda92d9ed922124238f9c80615..d04adcf4da46fb850c1046c519f0c4fc7b3e41d7 100644 (file)
--- a/mod/uservalidationbyemail/start.php
+++ b/mod/uservalidationbyemail/start.php
@@ -122,8 +122,11 @@ function uservalidationbyemail_allow_new_user_can_edit($hook, $type, $value, $pa
  */
 function uservalidationbyemail_check_auth_attempt($credentials) {
 
+       if (!isset($credentials['username'])) {
+               return;
+       }
+
        $username = $credentials['username'];
-       $password = $credentials['password'];
 
        // See if the user exists and isn't validated
        $access_status = access_get_show_hidden_status();