How to ensure CiviCRM checksum / cid are valid in custom Drupal module

Question

Follow up to an earlier question:

I am writing a simple custom Drupal module to display information about a contact's related organizations (see above for more background if interested).

One use case is that a logged in user sees this info, in which case determining whether to show the info is easy (I just use the Drupal contact ID to pull information from CiviCRM).

However, if someone visits the page from a checksum link sent via CiviMail, Drupal considers the user to be anonymous. I can pull the cid (CiviCRM contact ID) from the URL easily enough, but I need to be able to also verify the checksum in order to display information without a possibility of an information leak. How do I do that?

I found this function: CRM_Contact_BAO_Contact_Utils::generateChecksum($contactId) but this generates the checksum. I just need to verify an existing checksum (from the URL), not create a new one.

Answer 1

A little grepping around and I found this:

CRM_Contact_BAO_Contact_Utils::validChecksum($cid, $_GET["cs$c"])

which takes a CiviCRM contact id ($cid) and compares it to the checksum in the URL and did the trick for me as follows:

  $cid = check_plain($_GET['cid']);
  if ($cid != "" && CRM_Contact_BAO_Contact_Utils::validChecksum($cid, $_GET["cs$c"])) {
        //Contact ID and Checksum match up, embed a view 
        //with $cid as an argument (or other custom functionality)
  } else {
        //Not a match, decide what you want to do in this case 
        //(e.g. check if user is logged in, or display error...)
  }

UPDATE:

It looks like the usage has changed slightly in core since I pulled the above out of there (although the above was still working for me). Try this (taken from here):

    //check if this is a checksum authentication
$userChecksum = CRM_Utils_Request::retrieve('cs', 'String', $this);
if ($userChecksum) {
  //check for anonymous user.
  $validUser = CRM_Contact_BAO_Contact_Utils::validChecksum($tempID, $userChecksum);
  if ($validUser) {
    return $tempID;
  }
}