3

Follow up to an earlier question:

I am writing a simple custom Drupal module to display information about a contact's related organizations (see above for more background if interested).

One use case is that a logged in user sees this info, in which case determining whether to show the info is easy (I just use the Drupal contact ID to pull information from CiviCRM).

However, if someone visits the page from a checksum link sent via CiviMail, Drupal considers the user to be anonymous. I can pull the cid (CiviCRM contact ID) from the URL easily enough, but I need to be able to also verify the checksum in order to display information without a possibility of an information leak. How do I do that?

I found this function: CRM_Contact_BAO_Contact_Utils::generateChecksum($contactId) but this generates the checksum. I just need to verify an existing checksum (from the URL), not create a new one.

3

A little grepping around and I found this:

CRM_Contact_BAO_Contact_Utils::validChecksum($cid, $_GET["cs$c"])

which takes a CiviCRM contact id ($cid) and compares it to the checksum in the URL and did the trick for me as follows:

  $cid = check_plain($_GET['cid']);
  if ($cid != "" && CRM_Contact_BAO_Contact_Utils::validChecksum($cid, $_GET["cs$c"])) {
        //Contact ID and Checksum match up, embed a view 
        //with $cid as an argument (or other custom functionality)
  } else {
        //Not a match, decide what you want to do in this case 
        //(e.g. check if user is logged in, or display error...)
  }

UPDATE:

It looks like the usage has changed slightly in core since I pulled the above out of there (although the above was still working for me). Try this (taken from here):

    //check if this is a checksum authentication
$userChecksum = CRM_Utils_Request::retrieve('cs', 'String', $this);
if ($userChecksum) {
  //check for anonymous user.
  $validUser = CRM_Contact_BAO_Contact_Utils::validChecksum($tempID, $userChecksum);
  if ($validUser) {
    return $tempID;
  }
}
| improve this answer | |
  • We still need a few more experts like yourself to commit to area51.stackexchange.com/proposals/77367/… so the CiviCRM community can get their own StackExchange vs. adding questions and answers to the Drupal, WordPress, and Joomla exchanges. If you haven't committed already, please do and help spread the word. – kreynen Dec 15 '14 at 17:29
  • @kreynen thanks -- I'm already committed there and looking forward to the CiviCRM-specific exchange. – Laryn - CEDC.org Dec 16 '14 at 19:11
  • laryn - care to clarify a bit more about what you then did with CRM_Contact_BAO_Contact_Utils::validChecksum($cid, $_GET["cs$c"]) – petednz - fuzion May 15 '15 at 5:56
  • @petednz I added a small bit of code in the answer to flesh out the textual description in the question. – Laryn - CEDC.org May 15 '15 at 12:50
  • In your code, $c has a value. Any idea what it is ? – commonpike May 18 '15 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.