tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

FIX Ensure changing a password to blank is validated

Browse Source
This commit is contained in:
Steve Boyd 2021-06-17 12:05:20 +12:00
parent d5e4493851
commit 7ed7ad0254
3 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/Security/Member.php
View File

@ -875,7 +875,7 @@ class Member extends DataObject
if ($this->Email) { if ($this->Email) {
$this->Email = trim($this->Email); $this->Email = trim($this->Email);
} }
// If a member with the same "unique identifier" already exists with a different ID, don't allow merging. // If a member with the same "unique identifier" already exists with a different ID, don't allow merging.
// Note: This does not a full replacement for safeguards in the controller layer (e.g. in a registration form), // Note: This does not a full replacement for safeguards in the controller layer (e.g. in a registration form),
// but rather a last line of defense against data inconsistencies. // but rather a last line of defense against data inconsistencies.
@ -1705,8 +1705,8 @@ class Member extends DataObject
$valid = parent::validate(); $valid = parent::validate();
$validator = static::password_validator(); $validator = static::password_validator();
if (!$this->ID || $this->isChanged('Password')) { if ($validator) {
if ($this->Password && $validator) { if ((!$this->ID && $this->Password) || $this->isChanged('Password')) {
$userValid = $validator->validate($this->Password, $this); $userValid = $validator->validate($this->Password, $this);
$valid->combineAnd($userValid); $valid->combineAnd($userValid);
} }

2
src/Security/MemberPassword.php
View File

@ -53,6 +53,6 @@ class MemberPassword extends DataObject
public function checkPassword($password) public function checkPassword($password)
{ {
$encryptor = PasswordEncryptor::create_for_algorithm($this->PasswordEncryption); $encryptor = PasswordEncryptor::create_for_algorithm($this->PasswordEncryption);
return $encryptor->check($this->Password, $password, $this->Salt, $this->Member()); return $encryptor->check($this->Password ?? '', $password, $this->Salt, $this->Member());
} }
} }

12
tests/php/Security/MemberTest.php
View File

@ -1593,7 +1593,7 @@ class MemberTest extends FunctionalTest
$this->assertSame('Johnson', $member->getLastName(), 'getLastName should proxy to Surname'); $this->assertSame('Johnson', $member->getLastName(), 'getLastName should proxy to Surname');
} }
public function testEmailIsTrimmed() public function testEmailIsTrimmed()
{ {
$member = new Member(); $member = new Member();
@ -1601,4 +1601,14 @@ class MemberTest extends FunctionalTest
$member->write(); $member->write();
$this->assertNotNull(Member::get()->find('Email', 'trimmed@test.com')); $this->assertNotNull(Member::get()->find('Email', 'trimmed@test.com'));
} }
public function testChangePasswordToBlankIsValidated()
{
// override setup() function which setMinLength(0)
PasswordValidator::singleton()->setMinLength(8);
// 'test' member has a password defined in yml
$member = $this->objFromFixture(Member::class, 'test');
$result = $member->changePassword('');
$this->assertFalse($result->isValid());
}
} }