Deny empty password (#2488)

This commit is contained in:
Naoki Takezoe
2020-07-25 17:49:58 +09:00
committed by GitHub
parent c8f6017be9
commit 63d4c5054e

View File

@@ -17,7 +17,9 @@ trait AccountService {
def authenticate(settings: SystemSettings, userName: String, password: String)(
implicit s: Session
): Option[Account] = {
val account = if (settings.ldapAuthentication) {
val account = if (password.isEmpty) {
None
} else if (settings.ldapAuthentication) {
ldapAuthentication(settings, userName, password)
} else {
defaultAuthentication(userName, password)