fix: closes #14151, handle null req.body

src/controllers/authentication.js

@@ -221,6 +221,7 @@ authenticationController.login = async (req, res, next) => {
 	}
 
 	const loginWith = meta.config.allowLoginWith || 'username-email';
+	req.body = req.body || {};
 	req.body.username = String(req.body.username).trim();
 	const errorHandler = res.locals.noScriptErrors || helpers.noScriptErrors;
 	try {

test/authentication.js

@@ -284,6 +284,21 @@ describe('authentication', () => {
 		assert.equal(response.status, 500);
 	});
 
+	it('should fail to login if body is missing', async () => {
+		const jar = request.jar();
+		const csrf_token = await helpers.getCsrfToken(jar);
+
+		const { response, body } = await request.post(`${nconf.get('url')}/login`, {
+			body: null,
+			jar: jar,
+			headers: {
+				'x-csrf-token': csrf_token,
+			},
+		});
+		assert.equal(response.status, 403);
+		assert.strictEqual(body, '[[error:invalid-username-or-password]]');
+	});
+
 	it('should fail to login if user does not exist', async () => {
 		const { response, body } = await helpers.loginUser('doesnotexist', 'nopassword');
 		assert.equal(response.statusCode, 403);