0

In my project I have a content type called Person that is only viewable or editable by logged-in user. In this content type, I added some fields.

I want to give a person the ability to visit his profile. So I made a module called anonymous_profile with the following code.

function anonymous_profile_menu() {
    $items = array();
    $items['anonymous-profile-login'] = array(
        'title' => t('Login'),
        'page callback' => 'drupal_get_form',
        'page arguments' => array('anonymous_profile_login_form'),
        'access arguments' => array('access anonymous person login'),
        'type' => MENU_NORMAL_ITEM,
    );

    $items['anonymous-profile'] = array(
        'title' => t('Anonymous Visit'),
        'page callback' => 'anonymous_visit_page',
        'access arguments' => array('access anonymous person login'),
    );

    $items['anonymous-profile-logout'] = array(
        'title' => t(''),
        'page callback' => 'anonymous_logout',
        'access arguments' => array('access anonymous person login'),
    );
    return $items;
}

anonymous-profile-login creates a form where users insert information in order to log in on the anonymous-profile page. anonymous-profile-logout is the logout page.

function anonymous_profile_permission() {
    return array(
        'access anonymous person login' => array(
            'title' => t('access anonymous person login'),
            'description' => t('Anonymous person login form to view profile page.'),
        ),
    );
}

This is the form object that is returned to anonymous-profile-login.

function anonymous_profile_login_form() {
    $form['field_national_id'] = array(
        '#type' => 'textfield',
        '#title' => t('National ID'),
        '#size' => 10,
        '#maxlength' => 20,
        '#required' => TRUE,
        '#description' => t('Please insert your national id'),
    );

    $form['submit'] = array(
        '#type' => 'submit',
        '#value' => t('Login'),
    );

    return $form;
}

This is the form submission handler.

function anonymous_profile_login_form_submit($form, &$form_state) {
    $national_id = $form_state['values']['field_national_id'];

    $login_result = false;
    if ($national_id == '123456') { //this is for test.in real , inserted national id must be searched in database...

        $login_result = true;
    }

    if ($login_result) {
        drupal_set_message('Login is ok');
        $_SESSION['anonymous_logged_user'] = $national_id ;
        drupal_goto("anonymous-profile");
    } else {
        drupal_set_message('Invalid login information', 'error');
    }
}

This is the logout page.

function anonymous_logout() {
    if (isset($_SESSION['anonymous_logged_user']))
        unset($_SESSION['anonymous_logged_user']);
    drupal_goto('anonymous-profile-login');
}

In anonymous_visit_page(), first I check the session anonymous_logged_user; if it is OK, I show the information to the user.

function anonymous_visit_page() {
    if (isset($_SESSION['anonymous_logged_user'])) {
        if ($_SESSION['anonymous_logged_user'] > 0) {

            $national_id = $_SESSION['anonymous_logged_user'];
            // load information from database bases on $national_id and print rendered html output.

        }
    }
    //--------------------------
    //visitor is not logged via form
    drupal_set_message('You must loggin in order to see your profile', 'error');
    drupal_goto('anonymous-profile-login');

}

Is this solution safe?
Is a session alone enough for this method, or must I increase the code safety?
Is there any possibility the session is stolen, and users access information without log in via form?

I am using Drupal 7.

1

To answer a couple of questions asked:

  • Extra features to increase safety? You're tying identification/authorization together here; if I know an ID number then I'm authorized to view details associated with it. A malicious actor can just throw guesses at that field to start pulling data they shouldn't have access to. You should increase your authorization criteria (e.g. ask additional details to prove the user is who they say they are) and make the form more robust against brute-forcing (e.g. limit requests, use other bot-defeating tools, etc.).
  • Can a session be stolen? Yes. A PHP session is vulernable to session hijacking if you're using unsecure transport. You should enforce an encrypted session so you can rule that out.
  • Thanks. about the first item, of course I will add other fields and visitor must be insert national id, his email address and random number that is sent to his cell phone. so gesture will be hard. about the second item, you talked about encryption. can you tell me how can I do that in form submission? – Mehrdad201 Jul 12 '18 at 21:57
  • It will vary. D7 has a global property $is_https that you can check for secure transport, but note it depends on stack config; HTTPS is done at the web server or network level so Drupal could see HTTP transport despite having secure delivery to the end user. – Shawn Conn Jul 12 '18 at 22:12
  • Best practice is to set up the server so it always redirects from HTTP to HTTPS. Better to enforce secure sessions at the server level than try to have Drupal do it. – Alfred Armstrong Jul 13 '18 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.