3 files changed, 4 insertions, 4 deletions
diff --git a/modules/user/user.install b/modules/user/user.install
index df4b2670d..eaab91f94 100644
--- a/modules/user/user.install
+++ b/modules/user/user.install
@@ -251,7 +251,7 @@ function user_update_7000(&$sandbox) {
     $sandbox['user_count'] = db_result(db_query("SELECT COUNT(uid) FROM {users}"));
   }
   else {
-    require_once variable_get('password_inc', './includes/password.inc');
+    require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
     //  Hash again all current hashed passwords.
     $has_rows = FALSE;
     // Update this many per page load.
diff --git a/modules/user/user.module b/modules/user/user.module
index 73da67874..0dc6285a1 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -222,7 +222,7 @@ function user_save($account, $edit = array(), $category = 'account') {
 
   if (!empty($edit['pass'])) {
     // Allow alternate password hashing schemes.
-    require_once variable_get('password_inc', './includes/password.inc');
+    require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
     $edit['pass'] = user_hash_password(trim($edit['pass']));
     // Abort if the hashing failed and returned FALSE.
     if (!$edit['pass']) {
@@ -1310,7 +1310,7 @@ function user_authenticate($form_values = array()) {
     $account = db_fetch_object(db_query("SELECT * FROM {users} WHERE name = '%s' AND status = 1", $form_values['name']));
     if ($account) {
       // Allow alternate password hashing schemes.
-      require_once variable_get('password_inc', './includes/password.inc');
+      require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
       if (user_check_password($password, $account)) {
         if (user_needs_new_hash($account)) {
            $new_hash = user_hash_password($password);
diff --git a/modules/user/user.test b/modules/user/user.test
index 7110276b7..cc9066115 100644
--- a/modules/user/user.test
+++ b/modules/user/user.test
@@ -75,7 +75,7 @@ class UserRegistrationTestCase extends DrupalWebTestCase {
     $this->assertText(t('The changes have been saved.'), t('Password changed to @password', array('@password' => $new_pass)));
 
     // Make sure password changes are present in database.
-    require_once variable_get('password_inc', './includes/password.inc');
+    require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
 
     $user = user_load(array('uid' => $user->uid));
     $this->assertTrue(user_check_password($new_pass, $user), t('Correct password in database.'));