forbid empty password on user creation

owncloud · Oct 21, 2021 · d08623f · d08623f
1 parent 5268b8e
commit d08623f
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/changelog/unreleased/empty-password-user.md b/changelog/unreleased/empty-password-user.md
@@ -0,0 +1,5 @@
+Bugfix: Don't allow empty password
+
+It was allowed to create users with empty or spaces-only password. This is fixed
+
+https://github.com/owncloud/product/issues/197
diff --git a/ocs/pkg/service/v0/users.go b/ocs/pkg/service/v0/users.go
@@ -179,6 +179,11 @@ func (o Ocs) AddUser(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
+	if strings.TrimSpace(password) == "" {
+		mustNotFail(render.Render(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "empty password not allowed")))
+		o.logger.Error().Err(err).Str("userid", userid).Msg("empty password not allowed")
+		return
+	}
 
 	// fallbacks
 	/* TODO decide if we want to make these fallbacks. Keep in mind:

diff --git a/tests/acceptance/expected-failures-API-on-OCIS-storage.md b/tests/acceptance/expected-failures-API-on-OCIS-storage.md
@@ -916,9 +916,6 @@ special character username not valid
 -   [apiProvisioning-v2/addUser.feature:40](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiProvisioning-v2/addUser.feature#L40)
 -   [apiProvisioning-v2/addUser.feature:47](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiProvisioning-v2/addUser.feature#L47)
 
-#### [Password can be set to empty](https://github.com/owncloud/product/issues/197)
--   [apiProvisioning-v2/addUser.feature:83](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiProvisioning-v2/addUser.feature#L83)
-
 #### [Username is case sensitive](https://github.com/owncloud/ocis-accounts/issues/128)
 -   [apiProvisioning-v2/addUser.feature:116](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiProvisioning-v2/addUser.feature#L116)