Handle the password field having a value of null

[jonsa]

If any of the arguments to password_verify is null it will throw a TypeError.
This uses the same fix as Htpasswd.

zend-expressive-authentication/src/UserRepository/Htpasswd.php

Line 76 in 358795c

if ($found && password_verify($password ?? '', $hash)) {

[geerteltink]

Just wondering, in what scenario would you verify a null password?

[jonsa]

In my case I have a nullable password field in my table. My app is AD aware so most users will login automatically with their domain credentials but some can access the site externally with username and password.

I was just surprised by the TypeError and since it was handled Htpasswd I thought it might have been overlooked. I'll work around it by filtering out the users with null password in the sql if this is not accepted.

[geerteltink]

Thanx for the clarification. Makes perfect sense to me.

[ezimuel]

@jonsa thanks! I also added another test for empty password, just to be sure. Just released 1.0.1 with this fix.