forbid empty password on user creation

owncloud · Oct 21, 2021 · 9f2da29 · 9f2da29
1 parent 5268b8e
commit 9f2da29
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 14 deletions.
diff --git a/changelog/unreleased/empty-password-user.md b/changelog/unreleased/empty-password-user.md
@@ -0,0 +1,5 @@
+Bugfix: Don't allow empty password
+
+It was allowed to create users with empty or spaces-only password. This is fixed
+
+https://github.com/owncloud/product/issues/197
diff --git a/ocs/pkg/server/http/svc_test.go b/ocs/pkg/server/http/svc_test.go
@@ -169,6 +169,8 @@ var formats = []string{"json", "xml"}
 
 var dataPath = createTmpDir()
 
+var defaultPassword = "Testing123"
+
 var defaultUsers = []string{
 	userEinstein,
 	userIDP,
@@ -708,6 +710,10 @@ func getService() svc.Service {
 }
 
 func createUser(u User) error {
+	// add default password if not set differently
+	if u.Password == "" {
+		u.Password = defaultPassword
+	}
 	_, err := sendRequest(
 		"POST",
 		userProvisioningEndPoint,
@@ -767,17 +773,6 @@ func TestCreateUser(t *testing.T) {
 			},
 			nil,
 		},
-		// https://github.com/owncloud/ocis-ocs/issues/50
-		{
-			"User without password",
-			User{
-				Enabled:     "true",
-				ID:          "john",
-				Email:       "[email protected]",
-				Displayname: "John Dalton",
-			},
-			nil,
-		},
 		// https://github.com/owncloud/ocis-ocs/issues/49
 		{
 			"User with special character in userid",

diff --git a/ocs/pkg/service/v0/users.go b/ocs/pkg/service/v0/users.go
@@ -179,6 +179,11 @@ func (o Ocs) AddUser(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
+	if strings.TrimSpace(password) == "" {
+		mustNotFail(render.Render(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "empty password not allowed")))
+		o.logger.Error().Err(err).Str("userid", userid).Msg("empty password not allowed")
+		return
+	}
 
 	// fallbacks
 	/* TODO decide if we want to make these fallbacks. Keep in mind:

diff --git a/tests/acceptance/expected-failures-API-on-OCIS-storage.md b/tests/acceptance/expected-failures-API-on-OCIS-storage.md
@@ -916,9 +916,6 @@ special character username not valid
 -   [apiProvisioning-v2/addUser.feature:40](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiProvisioning-v2/addUser.feature#L40)
 -   [apiProvisioning-v2/addUser.feature:47](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiProvisioning-v2/addUser.feature#L47)
 
-#### [Password can be set to empty](https://github.com/owncloud/product/issues/197)
--   [apiProvisioning-v2/addUser.feature:83](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiProvisioning-v2/addUser.feature#L83)
-
 #### [Username is case sensitive](https://github.com/owncloud/ocis-accounts/issues/128)
 -   [apiProvisioning-v2/addUser.feature:116](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiProvisioning-v2/addUser.feature#L116)