Merge pull request #10895 from creative-commoners/pulls/4.13/cve-2023-32302

[CVE-2023-32302] Require password field to be non-empty
2023-07-31 11:24:46 +12:00 · 2023-07-31 11:24:46 +12:00 · 0a1c46e69f
parent cb7be276e7 7b21b38ac4
commit 0a1c46e69f
1 changed files with 1 additions and 1 deletions
--- a/src/Security/Member.php
+++ b/src/Security/Member.php
@ -731,7 +731,7 @@ class Member extends DataObject
            $password->setRequireExistingPassword(true);
        }

-        $password->setCanBeEmpty(true);
+        $password->setCanBeEmpty(false);
        $this->extend('updateMemberPasswordField', $password);

        return $password;