[CVE-2023-32302] Require password field to be non-empty

2023-05-12 12:24:12 +12:00 · 2023-05-12 12:24:12 +12:00 · 7b21b38ac4
parent cb7be276e7
commit 7b21b38ac4
1 changed files with 1 additions and 1 deletions
--- a/src/Security/Member.php
+++ b/src/Security/Member.php
@ -731,7 +731,7 @@ class Member extends DataObject
            $password->setRequireExistingPassword(true);
        }

-        $password->setCanBeEmpty(true);
+        $password->setCanBeEmpty(false);
        $this->extend('updateMemberPasswordField', $password);

        return $password;