- Patch #497612 by Moshe Weitzman et al: harden user login by correctly using the form API. Complete commit now. Thank you, thank you.

1 files changed, 6 insertions, 5 deletions

diff --git a/modules/blogapi/blogapi.module b/modules/blogapi/blogapi.module
index ef8e22693..9f9549bb3 100644
--- a/modules/blogapi/blogapi.module
+++ b/modules/blogapi/blogapi.module
@@ -683,13 +683,14 @@ function blogapi_error($message) {
  * Ensure that the given user has permission to edit a blog.
  */
 function blogapi_validate_user($username, $password) {
-  global $user;
+  $form_state['values']['name'] = $username;
+  $form_state['values']['pass'] = $password;
+  $form_state['values']['op'] = t('Login');
+  drupal_form_submit('user_login', $form_state);
 
-  $user = user_authenticate(array('name' => $username, 'pass' => $password));
-
-  if ($user->uid) {
+  if (!form_get_error()) {
     if (user_access('administer content with blog api', $user)) {
-      return $user;
+      return $GLOBALS['user'];
     }
     else {
       return t('You do not have permission to edit this blog.');