-1

I am developping a module which allows users to modify information about themselves using a form. I want to make sure no user is able to modify the informations about another user. To do this, I thought I could use the uid provided in the $user global variable. So my question is: is this safe enough? Or is it somehow possible for $user->uid to return something other than the current user's uid? In other words, is it possible to cheat the $user global object?

This is not the best way to ask this question, feel free to suggest improvements.

edit: Another way of asking this is: Does $user->uid return something different than 0 only in the case where the current user has been properly authenticated?

4

In short, yes, what you describe is how Drupal identifies the active, logged-in user. Wherever possible, though, you should use API functions such as user_access('module permission') to check access rights, where 'module permission' is a string defined in your module's hook_permission function and set for each role on the admin permissions page.

Edit: If you want to see if the current user is authenticated, check to see if $user has the authenticated user role. See Check if a user has a role

  • If I understand correctly, functions like user_access('module permission') check a user's access rights (or rather a role's access rights) to a module. What I need are user access rights to a specific row in a database table (the row with the user's uid as its primary key). This is different, is it not? – Shawn Oct 18 '12 at 21:20
  • I didn't understand what you were trying to do from your question, but now I see, and yes, you are right. You can assume that $user->uid == 0 for the anonymous user, and if you write $user->uid into a database table, you can be sure that it will uniquely identify that user. – greg_1_anderson Oct 18 '12 at 21:53
2

Or is it somehow possible for $user->uid to return something other than the current user's uid?

The user object is initialized in _drupal_session_read() using the following code. (_drupal_session_read() is a session handler set by Drupal.)

// Secure page session.
$user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.ssid = :ssid", array(':ssid' => $sid))->fetchObject();
// Not secure page session.
$user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.ssid = :ssid", array(':ssid' => $sid))->fetchObject();

$sid is the session ID.

For authenticated users, the session ID is generated in drupal_session_regenerate() using the following code.

$session_id = drupal_hash_base64(uniqid(mt_rand(), TRUE) . drupal_random_bytes(55));

$user is initialized to currently logged-in user if:

  • $_COOKIE[session_name()], or $_COOKIE[substr(session_name(), 1)] is set
  • There is a database row in the sessions tables for the current session ID

In the other cases, $user is initialized to the object for the anonymous user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.