From 5699cb22bb10a8b33a9f4854e8a50afeb4b7b2b7 Mon Sep 17 00:00:00 2001 From: Christian Flothmann Date: Tue, 3 Dec 2019 13:13:07 +0100 Subject: [PATCH] do not validate passwords when the hash is null --- .../Authentication/Provider/DaoAuthenticationProvider.php | 2 +- .../Security/Core/Encoder/UserPasswordEncoder.php | 4 ++++ .../Provider/DaoAuthenticationProviderTest.php | 7 ++++--- .../Core/Validator/Constraints/UserPasswordValidator.php | 2 +- 4 files changed, 10 insertions(+), 5 deletions(-) diff --git a/src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php b/src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php index 9d846d5f26..1d90434424 100644 --- a/src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php +++ b/src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php @@ -61,7 +61,7 @@ class DaoAuthenticationProvider extends UserAuthenticationProvider throw new BadCredentialsException('The presented password cannot be empty.'); } - if (!$this->encoderFactory->getEncoder($user)->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) { + if (null === $user->getPassword() || !$this->encoderFactory->getEncoder($user)->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) { throw new BadCredentialsException('The presented password is invalid.'); } } diff --git a/src/Symfony/Component/Security/Core/Encoder/UserPasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/UserPasswordEncoder.php index 3efc8c6d48..479a5731c2 100644 --- a/src/Symfony/Component/Security/Core/Encoder/UserPasswordEncoder.php +++ b/src/Symfony/Component/Security/Core/Encoder/UserPasswordEncoder.php @@ -42,6 +42,10 @@ class UserPasswordEncoder implements UserPasswordEncoderInterface */ public function isPasswordValid(UserInterface $user, $raw) { + if (null === $user->getPassword()) { + return false; + } + $encoder = $this->encoderFactory->getEncoder($user); return $encoder->isPasswordValid($user->getPassword(), $raw, $user->getSalt()); diff --git a/src/Symfony/Component/Security/Core/Tests/Authentication/Provider/DaoAuthenticationProviderTest.php b/src/Symfony/Component/Security/Core/Tests/Authentication/Provider/DaoAuthenticationProviderTest.php index bb0576fb4c..7f46b1bcae 100644 --- a/src/Symfony/Component/Security/Core/Tests/Authentication/Provider/DaoAuthenticationProviderTest.php +++ b/src/Symfony/Component/Security/Core/Tests/Authentication/Provider/DaoAuthenticationProviderTest.php @@ -15,6 +15,7 @@ use PHPUnit\Framework\TestCase; use Symfony\Component\Security\Core\Authentication\Provider\DaoAuthenticationProvider; use Symfony\Component\Security\Core\Encoder\PlaintextPasswordEncoder; use Symfony\Component\Security\Core\Exception\UsernameNotFoundException; +use Symfony\Component\Security\Core\User\User; class DaoAuthenticationProviderTest extends TestCase { @@ -151,7 +152,7 @@ class DaoAuthenticationProviderTest extends TestCase $method->invoke( $provider, - $this->getMockBuilder('Symfony\\Component\\Security\\Core\\User\\UserInterface')->getMock(), + new User('username', 'password'), $token ); } @@ -175,7 +176,7 @@ class DaoAuthenticationProviderTest extends TestCase ->willReturn('foo') ; - $method->invoke($provider, $this->getMockBuilder('Symfony\\Component\\Security\\Core\\User\\UserInterface')->getMock(), $token); + $method->invoke($provider, new User('username', 'password'), $token); } public function testCheckAuthenticationDoesNotReauthenticateWhenPasswordHasChanged() @@ -247,7 +248,7 @@ class DaoAuthenticationProviderTest extends TestCase ->willReturn('foo') ; - $method->invoke($provider, $this->getMockBuilder('Symfony\\Component\\Security\\Core\\User\\UserInterface')->getMock(), $token); + $method->invoke($provider, new User('username', 'password'), $token); } protected function getSupportedToken() diff --git a/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php b/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php index 41559a3adc..98175036f7 100644 --- a/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php +++ b/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php @@ -53,7 +53,7 @@ class UserPasswordValidator extends ConstraintValidator $encoder = $this->encoderFactory->getEncoder($user); - if (!$encoder->isPasswordValid($user->getPassword(), $password, $user->getSalt())) { + if (null === $user->getPassword() || !$encoder->isPasswordValid($user->getPassword(), $password, $user->getSalt())) { $this->context->addViolation($constraint->message); } }