3

Follow up to an earlier question:

I am writing a simple custom Drupal module to display information about a contact's related organizations (see above for more background if interested).

One use case is that a logged in user sees this info, in which case determining whether to show the info is easy (I just use the Drupal contact ID to pull information from CiviCRM).

However, if someone visits the page from a checksum link sent via CiviMail, Drupal considers the user to be anonymous. I can pull the cid (CiviCRM contact ID) from the URL easily enough, but I need to be able to also verify the checksum in order to display information without a possibility of an information leak. How do I do that?

I found this function: CRM_Contact_BAO_Contact_Utils::generateChecksum($contactId) but this generates the checksum. I just need to verify an existing checksum (from the URL), not create a new one.

1 Answer 1

3

A little grepping around and I found this:

CRM_Contact_BAO_Contact_Utils::validChecksum($cid, $_GET["cs$c"])

which takes a CiviCRM contact id ($cid) and compares it to the checksum in the URL and did the trick for me as follows:

  $cid = check_plain($_GET['cid']);
  if ($cid != "" && CRM_Contact_BAO_Contact_Utils::validChecksum($cid, $_GET["cs$c"])) {
        //Contact ID and Checksum match up, embed a view 
        //with $cid as an argument (or other custom functionality)
  } else {
        //Not a match, decide what you want to do in this case 
        //(e.g. check if user is logged in, or display error...)
  }

UPDATE:

It looks like the usage has changed slightly in core since I pulled the above out of there (although the above was still working for me). Try this (taken from here):

    //check if this is a checksum authentication
$userChecksum = CRM_Utils_Request::retrieve('cs', 'String', $this);
if ($userChecksum) {
  //check for anonymous user.
  $validUser = CRM_Contact_BAO_Contact_Utils::validChecksum($tempID, $userChecksum);
  if ($validUser) {
    return $tempID;
  }
}
8
  • We still need a few more experts like yourself to commit to area51.stackexchange.com/proposals/77367/… so the CiviCRM community can get their own StackExchange vs. adding questions and answers to the Drupal, WordPress, and Joomla exchanges. If you haven't committed already, please do and help spread the word.
    – kreynen
    Dec 15, 2014 at 17:29
  • @kreynen thanks -- I'm already committed there and looking forward to the CiviCRM-specific exchange.
    – Laryn
    Dec 16, 2014 at 19:11
  • laryn - care to clarify a bit more about what you then did with CRM_Contact_BAO_Contact_Utils::validChecksum($cid, $_GET["cs$c"]) May 15, 2015 at 5:56
  • @petednz I added a small bit of code in the answer to flesh out the textual description in the question.
    – Laryn
    May 15, 2015 at 12:50
  • In your code, $c has a value. Any idea what it is ?
    – commonpike
    May 18, 2015 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.