PoC: Return contact ID when logged in via checksum

[mattwire]

Overview

CRM_Core_Session::getLoggedInContactID() returns NULL when a contact is "logged in" via a checksum link. This doesn't really make sense because they can do everything that they would have been able to do if "logged in" via a normal session.

I've seen a lot of code that makes the assumption that

if (CRM_Core_Session::getLoggedInContactID() === NULL) {
  // do anonymous user stuff
}

Inspired by the new loginsecurity extension by @mlutfy

Before

getLoggedInContactID() doesn't always do what you expect (if logged in via checksum).

After

Default behaviour is not changed. It is explicit because the parameter makes it clear that you will not get the checksum Contact ID unless you specifically request that behaviour.

Technical Details

Comments

[civibot]

(Standard links)

• If this is your first pull-request for CiviCRM, please browse CONTRIBUTING.md for information about the development and testing processes.
• If you are reviewing this pull-request, you may wish to consult the test sites and the Review Standards (long template, short template).

[mlutfy]

Thanks for raising this. I have to admit I've run into checksum inconsistencies a few times.

Are there legitimate use-cases for ignoring the checksum? i.e. for requiring a function parameter? Otherwise as a first step, we could create a separate function? (so that extensions such as loginsecurity do not improvise/duplicate their own validation code).

Test fails are weird:

    CRM_Contribute_Form_ContributionTest.testSubmit with data set #0
    CRM_Contribute_Form_ContributionTest.testSubmit with data set #1
    CRM_Contribute_Form_ContributionTest.testSubmitEmailReceiptUserEmailFromAddress
    CRM_Contribute_Form_ContributionTest.testEmailReceiptOnPayLater
    CRM_Contribute_Form_ContributionTest.testPartialPaymentWithCreditCard
    CRM_Contribute_Form_ContributionTest.testCardTypeAndPanTruncation

[mlutfy]

jenkins, test this please

[demeritcowboy]

This has been WIP for a few months so going to close.

I'm personally not clear on what "logged in via checksum" means with respect to permissions when there is no associated cms user to look them up for, so that may be why there's some inconsistencies.