User: Skipping password hash and contain plain password on the database

[itpcc]

Node.js version:
v8.10.0 LTS
npm version:
5.7.1
Strapi version:
3.0.0-alpha.11.1
Operating system:
WIndows 10:

PS D:\app> [System.Environment]::OSVersion.Version

Major  Minor  Build  Revision
-----  -----  -----  --------
10     0      16299  0

Do you want to request a feature or report a bug?
Bug

What is the current behavior?
I create the Strapi app using strapi start. When I adding a user via http://localhost:1337/admin/plugins/content-manager/user/create?source=users-permissions, bcrypt.hash will work (bcryptjs is neither mentioned in the package.json file nor installed in node_modules folder. ), skip the checking process, and save into the database directly as a plain text.

So, when I tried to log in via POST http://localhost:1337/auth/local, it'll throw an error: Identifier or password invalid..

Strangely, If I use an admin credential, it'll work just fine, and save into database with a hashed password.

If the current behavior is a bug, please provide the steps to reproduce the problem

• Create a new app using [this instruction] (https://strapi.io/documentation/getting-started/quick-start.html)
• Create admin user.
• Create some random account using admin backend.
• Check the database.

What is the expected behavior?
It should ~~~either~~~:

• ~~Throw an error about bcrypt. Or ~~
• Hash the password properly

Suggestion
I check using console.log and found that value send to User.add service (Path: \plugins\users-permissions\services\User.js) is in this form:

{ fields: { username: 'aasss', email: 'aa@ss.co', password: '111111' },
 files: {} }

But the logic used to check password exist was: (line 21)

if (values.password) {
      values.password = await strapi.plugins['users-permissions'].services.user.hashPassword(values);
    }

So, IMO, this line should be changed to:

if (values.password) {
      values.password = await strapi.plugins['users-permissions'].services.user.hashPassword(values);
    }else if(values.fields.password) {
      values.fields.password = await strapi.plugins['users-permissions'].services.user.hashPassword(values.fields);
    }

Oh, and the edit method too!
I test, and the problem solved. 😄

[lauriejim]

Hi @itpcc follow this issue #765
Thank you for this report.