Double-negative auth: a vulnerability story

In university I ran a Drupal website for an undergraduate student body. The university had a single-sign-on system called “Raven”, and happily someone had already had written a Drupal 5 module to allow using Raven authentication, called “ucamraven“. When Drupal 6 came out, I dutifully wrote a Drupal 6 version of ucamraven but got stuck […]