Drupal 7: Check user password during custom login form validation

Question

I'm working on a project in Drupal 7 where I need to alter the default message that gets presented to the user on a failed login attempt. I need to give them one message if their username isn't found, and another if their password is wrong (Drupal default is to give a single, generic error message that doesn't distinguish between the two).

The username check is a cinch. For the password check, The best solution I've found is user_check_password(). This doesn't sit well with me. The password.inc file isn't included in all page requests, and as there are several different context dependent login pages on the site, it isn't always there. I've been forced to require_once it in my custom validation handler which seems very un-drupal-ish.

Does anyone know of a better way to figure out if a user has entered the wrong password during custom user login validation?

user2923779 user2923779 · Accepted Answer · 2013-12-23T20:50:25

I think you should feel comfortable doing this. It was obviously a conscience decision to not always include the file during Drupal bootstrap. If you look at the code in user.module you will see that they use require_once whenever a function from that file is needed https://api.drupal.org/api/drupal/modules%21user%21user.module/7.

If you insist on not doing require_once here is the other option I see (without hacking Drupal core)

$name = $form_state['values']['your_name_field'];
$pass = $form_state['values']['your_pass_field'];
$account = user_load_by_name($name);
if(!$account){
  // you know they entered a bad username
}

if(!user_authenticate($name, $pass)){
  // you know the password was the culprit
}

You will not incur any extra queries this way. user_authenticate uses user_load_by_name and deep down in the entity load function there is static cacheing.

Drupal 7: Check user password during custom login form validation

1 Answers