From 4fd1b09a600a90d37d8f0e6d7721e2a09b38f429 Mon Sep 17 00:00:00 2001 From: Tobias Assmann Date: Fri, 9 Jul 2021 09:35:12 +0200 Subject: [PATCH] draft to prevent the invalidation of pw based authn tokens on a pw less login Signed-off-by: Tobias Assmann --- .../Authentication/Listeners/UserLoggedInListener.php | 5 +++++ lib/private/Authentication/Token/PublicKeyTokenProvider.php | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/lib/private/Authentication/Listeners/UserLoggedInListener.php b/lib/private/Authentication/Listeners/UserLoggedInListener.php index 711a759fad4..d0ad8e2e838 100644 --- a/lib/private/Authentication/Listeners/UserLoggedInListener.php +++ b/lib/private/Authentication/Listeners/UserLoggedInListener.php @@ -49,6 +49,11 @@ class UserLoggedInListener implements IEventListener { return; } + // prevent setting an empty pw as result of pw-less-login + if ($event->getPassword()==='') { + return; + } + // If this is already a token login there is nothing to do if ($event->isTokenLogin()) { return; diff --git a/lib/private/Authentication/Token/PublicKeyTokenProvider.php b/lib/private/Authentication/Token/PublicKeyTokenProvider.php index a293d2a8404..222e5cba099 100644 --- a/lib/private/Authentication/Token/PublicKeyTokenProvider.php +++ b/lib/private/Authentication/Token/PublicKeyTokenProvider.php @@ -414,6 +414,11 @@ class PublicKeyTokenProvider implements IProvider { public function updatePasswords(string $uid, string $password) { $this->cache->clear(); + // prevent setting an empty pw as result of pw-less-login + if ($password==='') { + return; + } + // Update the password for all tokens $tokens = $this->mapper->getTokenByUser($uid); foreach ($tokens as $t) {