[jan] SECURITY: Don't allow to login with an emtpy password.

horde · Jul 6, 2015 · e81d3d4 · e81d3d4
1 parent 4d5c3ca
commit e81d3d4
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/framework/Core/lib/Horde/Core/Auth/Application.php b/framework/Core/lib/Horde/Core/Auth/Application.php
@@ -124,6 +124,10 @@ public function __construct(array $params = array())
      */
     public function authenticate($userId, $credentials, $login = true)
     {
+        if (!strlen($credentials['password'])) {
+            return false;
+        }
+
         try {
             list($userId, $credentials) = $this->runHook(trim($userId), $credentials, 'preauthenticate', 'authenticate');
          } catch (Horde_Auth_Exception $e) {

diff --git a/framework/Core/package.xml b/framework/Core/package.xml
@@ -39,6 +39,7 @@
  </stability>
  <license uri="http://www.horde.org/licenses/lgpl21">LGPL-2.1</license>
  <notes>
+* [jan] SECURITY: Don&apos;t allow to login with an emtpy password.
 * [jan] Give administrators access to all groups, even with $conf[&apos;share&apos;][&apos;any_group&apos;] disabled.
  </notes>
  <contents>
@@ -3963,6 +3964,7 @@
    <date>2015-06-11</date>
    <license uri="http://www.horde.org/licenses/lgpl21">LGPL-2.1</license>
    <notes>
+* [jan] SECURITY: Don&apos;t allow to login with an emtpy password.
 * [jan] Give administrators access to all groups, even with $conf[&apos;share&apos;][&apos;any_group&apos;] disabled.
    </notes>
   </release>