Only allow login via basic per-user if user password is set
Signed| @@ -43,10 +43,6 @@ const basicAuthMiddleware = async function (request, response, callback) { | |||
| 43 | if (user && user.enabled && (user.password && user.password === getPasswordHash(password, user.salt))) { | 43 | if (user && user.enabled && (user.password && user.password === getPasswordHash(password, user.salt))) { |
| 44 | return callback(); | 44 | return callback(); |
| 45 | } | 45 | } |
| 46 | else if (user && user.enabled && !user.password && !password) { | ||
| 47 | // Login to an account without password | ||
| 48 | return callback(); | ||
| 49 | } | ||
| 50 | } | 46 | } |
| 51 | } | 47 | } |
| 52 | } | 48 | } |
| @@ -678,11 +678,6 @@ async function basicUserLogin(request) { | |||
| 678 | request.session.handle = userHandle; | 678 | request.session.handle = userHandle; |
| 679 | return true; | 679 | return true; |
| 680 | } | 680 | } |
| 681 | else if (user && user.enabled && !user.password && !password) { | ||
| 682 | // Login to an account without password | ||
| 683 | request.session.handle = userHandle; | ||
| 684 | return true; | ||
| 685 | } | ||
| 686 | } | 681 | } |
| 687 | } | 682 | } |
| 688 | 683 | ||