0

I'm part of a team that's going to be migrating several older Drupal sites (Drupal 5, Drupal 6) into a new, single Drupal 7 site. I'm familiar with Drupal from a software architecture point of view, but not as familiar with the day to day running of a Drupal site as I'd like. Because of this I have a few general questions about this migration.

Are Drupal's password hashing mechanisms consistent across different versions?

If not, are there tools to support migrating user accounts and converting the passwords between versions?

If a no to migrations, are there modules that provide a standard experience for this situation that allows an old user to pick a new password?

1

Are Drupal's password hashing mechanisms consistent across different versions?

No, D7 and D8 use SHA512 with a salt. Drupal 6 uses MD5 without a salt.

If not, are there tools to support migrating user accounts and converting the passwords between versions?

Yes you can just rehash them.

If a no to migrations, are there modules that provide a standard experience for this situation that allows an old user to pick a new password?

Yes there is a really simple way (one example is). Make sure you BACKUP before you do anything. If this does not work for you, google how to convert drupal 6 passwords to drupal 7. There is a ton of different ways.

<?php
        require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
        $res = db_query('select * from drupal.users');

        if($res) {
                foreach ($res as $result) {
                        $hashed_pass = user_hash_password($result->pass, 11);
                        if ($hashed_pass) {
                          $hashed_pass  = 'U' . $hashed_pass;
                          db_update('users')->fields(array('pass' => $hashed_pass))->condition('uid', $result->uid)->execute();
                        }
                }
        }
  • My apologies, but I seem to be missing something obvious. Since Drupal stores only a hash of the password and not the plain text password — wouldn't the above be hashing the hash, which would fail to preserve the user's original password? – Alan Storm Oct 16 '13 at 19:06
  • 1
    If you notice what we do is we append "U" before the new hash. What this does is it tells Drupal 7 that it is an updated hash, and it is processed differently. Then when a user logs in it updates the hash with the proper SHA512, you can see api.drupal.org/api/drupal/modules%21user%21user.install/… and api.drupal.org/api/drupal/includes%21password.inc/function/… for an example of why/how this works. – Steven Oct 16 '13 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.