0

I was running through some tests on my site with a client, and I was logged in as a normal authenticated user. I then logged out with the intention of logging back in as the superadmin (uid -> 1).

I navigated to a node page where there was a login form, and the site automatically logged me in as the authenticated user that I was logged in as previously.

Do you have any ideas of what could be causing this? The page that where this auto-login occurred reads off of a custom node.tpl file and I've got a few user_load() calls in that code.

  • Have you checked that cookies are being cleared? – cam8001 Sep 25 '11 at 15:12
  • Could you be more specific about your setup? Could you using any 3rd party modules or rules that you forgot about? – Stan Ascher Jan 23 '12 at 5:35
  • curious..have you been successful in reproducing this problem? – optimusprime619 Mar 23 '12 at 6:47
1

If you are also using the global $user object in your code, doing something like $user=user_load($node->uid) can 'log you in'. This is a security issue and should be corrected.

1

It sounds like you have a global $user object that you are then overwriting.

The problem code would look something like:

global $user;
$user = user_load($new_user_id);

Search though all of your code for any occurrences of user_load() to locate the problem line.

For safety I usually use copy the global $user to an $account object so I can be user nothing will change the global $user.

For example:

global $user;
$account = $user;

// Do stuff with $account safe in the knowledge that even if I 
// accidentally change it it won't effect the global $user object
0

I would advise to check caching settings. If you have multiple user_load() calls in page.tpl, and still get previous version of the page, that's a sign of page.tpl not being called at all. So, first of all, check that you don't have aggressive caching/wrong boost settings

  • Well I know that the page.tpl is being called because the $content variable (which displays the node content) in page.tpl along with regions etc. displays the page that I'm viewing. I have drupal's general cache settings set to normal. I wouldn't expect the general cache settings to effect the user sessions like that... – user2014 Aug 25 '11 at 16:37
0

Are you using some browser plugin to store login information like Lastpass? Maybe it automatically sign you in everytime you are trying to access the login page. Did you clear your browser cookies? I was in the same problem before but I found out that my plugin(Lastpass) was the root cause of my problem. Try to browse in incognito or use other browser.

0

Something like this has happened to me before. There was a case of checking whether the current user is the admin. Instead of checking of equality

if($user->uid==1){ 
    // put code here
}

I did assignement

if($user->uid==1){ 
    // put code here
}
  • you should use '===' instead of '==' in such an important if statement. – saadlulu Mar 14 '13 at 6:50
  • @saadlulu not need '===' !!! – Yusef Mohamadi Feb 18 '14 at 7:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy