Get new password in cleartext when a user changes it in Drupal?

Question

In my Drupal module I'm attempting to hook in where a user changes their password. I need this in cleartext for something else.

So I did the basic thing and used tcauth_user_presave() . I then changed my password which triggered a logging function. However when I looked at the log the provided &$edit , $account , and $category variables didn't contain the new password in cleartext. The only thing that was available was the old password (in cleartext) and the new password hashed.

Is there anyway to get the cleartext password when someone changes it? This is Drupal 7 if it matters.

Answer 1

The password is hashed in user_save() before the presave hook is called.

Looks like there is another option than altering the form, however. Before user_save() is called in user_profile_form_submit() , hook_field_attach_submit() is invoked through the entity_form_submit_build_entity() helper function. Although it's a field hook, it does recieve the full user object as $entity.

Not sure if that is really the better than altering the form because the hook is invoked for all entity changes, not just users.

Answer 2

I'm not sure if it's the best place to catch it, but the plain text input is available within hook_form_alter:

function testing_form_alter(&$form, &$form_state, $form_id) {
  if ($form_id = 'user_profile_form') {
    dpm($form_state['input']['pass']['pass1']);
  }
}

UPDATE : I did some more digging around. I think the way I'd tackle it would be to add another submit handler to user_profile_form, making sure to add it to the array before user_profile_form_submit. You'd then have full access to the password, before it gets encoded by user_profile_form_submit. Post a comment, if you need more details.

Answer 3

This is my example. It's helpful in my case to read the new password.

/**
 * Implement hook_field_attach_submit().
 */
function yourmodulename_field_attach_submit($entity_type, $entity, $form, &$form_state) {
  if ($entity_type == 'user') {
    // deal with $form["#user"]->pass;
  }
}

Answer 4

在hook_user_update()上尝试一下

$_POST['pass']['pass2']