Only allow login via basic per-user if user password is set
Signed| @@ -43,10 +43,6 @@ const basicAuthMiddleware = async function (request, response, callback) { | ||
| 43 | 43 | if (user && user.enabled && (user.password && user.password === getPasswordHash(password, user.salt))) { |
| 44 | 44 | return callback(); |
| 45 | 45 | } |
| 46 | - else if (user && user.enabled && !user.password && !password) { | |
| 47 | - // Login to an account without password | |
| 48 | - return callback(); | |
| 49 | - } | |
| 50 | 46 | } |
| 51 | 47 | } |
| 52 | 48 | } |
| @@ -678,11 +678,6 @@ async function basicUserLogin(request) { | ||
| 678 | 678 | request.session.handle = userHandle; |
| 679 | 679 | return true; |
| 680 | 680 | } |
| 681 | - else if (user && user.enabled && !user.password && !password) { | |
| 682 | - // Login to an account without password | |
| 683 | - request.session.handle = userHandle; | |
| 684 | - return true; | |
| 685 | - } | |
| 686 | 681 | } |
| 687 | 682 | } |
| 688 | 683 | |