Merge pull request GEOLYTIX#1119 from dbauszus-glx/null-password

Err on null password login
cityremade · Feb 8, 2024 · 2cf1041 · 2cf1041
2 parents e53c450 + 8c74d5d
commit 2cf1041
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/mod/user/fromACL.js b/mod/user/fromACL.js
@@ -52,6 +52,12 @@ module.exports = async (req) => {
 
   const user = await getUser(request)
 
+  if (user === undefined) {
+
+    // This will happen when a user has a null password.
+    return new Error('auth_failed')
+  }
+
   if (user instanceof Error) {
 
     return await failedLogin(request)
@@ -80,6 +86,8 @@ async function getUser(request) {
 
   if (!user) return new Error('auth_failed')
 
+  if (!user.password) return;
+
   // Blocked user cannot login.
   if (user.blocked) {
     return new Error(await languageTemplates({