Stronger passwordless account checks (fixes
MODIFY
userapi/internal/api.go
userapi/internal/api.go
@@ -838,6 +838,8 @@ func (a *UserInternalAPI) QueryAccountByPassword(ctx context.Context, req *api.Q
return nil
case bcrypt.ErrMismatchedHashAndPassword: // user exists, but password doesn't match
return nil
+ case bcrypt.ErrHashTooShort: // user exists, but probably a passwordless account
+ return nil
default:
res.Exists = true
res.Account = acc

MODIFY
userapi/storage/shared/storage.go
userapi/storage/shared/storage.go
@@ -75,6 +75,9 @@ func (d *Database) GetAccountByPassword(
if err != nil {
return nil, err
}
+ if hash == "" {
+ return nil, bcrypt.ErrHashTooShort
+ }
if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(plaintextPassword)); err != nil {
return nil, err
}

Stronger passwordless account checks (fixes #2780)