symfony · chalasr · Dec 3, 2019 · Dec 3, 2019
diff --git a/src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php b/src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php
@@ -61,7 +61,7 @@ protected function checkAuthentication(UserInterface $user, UsernamePasswordToke
                throw new BadCredentialsException('The presented password cannot be empty.');
            }

-            if (!$this->encoderFactory->getEncoder($user)->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) {
+            if (null === $user->getPassword() || !$this->encoderFactory->getEncoder($user)->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) {
                throw new BadCredentialsException('The presented password is invalid.');
            }
        }

diff --git a/src/Symfony/Component/Security/Core/Encoder/UserPasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/UserPasswordEncoder.php
@@ -42,6 +42,10 @@ public function encodePassword(UserInterface $user, $plainPassword)
     */
    public function isPasswordValid(UserInterface $user, $raw)
    {
+        if (null === $user->getPassword()) {
+            return false;
+        }
+
        $encoder = $this->encoderFactory->getEncoder($user);

        return $encoder->isPasswordValid($user->getPassword(), $raw, $user->getSalt());

diff --git a/...y/Component/Security/Core/Tests/Authentication/Provider/DaoAuthenticationProviderTest.php b/...y/Component/Security/Core/Tests/Authentication/Provider/DaoAuthenticationProviderTest.php
@@ -15,6 +15,7 @@
 use Symfony\Component\Security\Core\Authentication\Provider\DaoAuthenticationProvider;
 use Symfony\Component\Security\Core\Encoder\PlaintextPasswordEncoder;
 use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
+use Symfony\Component\Security\Core\User\User;

 class DaoAuthenticationProviderTest extends TestCase
 {
@@ -151,7 +152,7 @@ public function testCheckAuthenticationWhenCredentialsAre0()

        $method->invoke(
            $provider,
-            $this->getMockBuilder('Symfony\\Component\\Security\\Core\\User\\UserInterface')->getMock(),
+            new User('username', 'password'),
            $token
        );
    }
@@ -175,7 +176,7 @@ public function testCheckAuthenticationWhenCredentialsAreNotValid()
              ->willReturn('foo')
        ;

-        $method->invoke($provider, $this->getMockBuilder('Symfony\\Component\\Security\\Core\\User\\UserInterface')->getMock(), $token);
+        $method->invoke($provider, new User('username', 'password'), $token);
    }

    public function testCheckAuthenticationDoesNotReauthenticateWhenPasswordHasChanged()
@@ -247,7 +248,7 @@ public function testCheckAuthentication()
              ->willReturn('foo')
        ;

-        $method->invoke($provider, $this->getMockBuilder('Symfony\\Component\\Security\\Core\\User\\UserInterface')->getMock(), $token);
+        $method->invoke($provider, new User('username', 'password'), $token);
    }

    protected function getSupportedToken()

diff --git a/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php b/src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php
@@ -53,7 +53,7 @@ public function validate($password, Constraint $constraint)

        $encoder = $this->encoderFactory->getEncoder($user);

-        if (!$encoder->isPasswordValid($user->getPassword(), $password, $user->getSalt())) {
+        if (null === $user->getPassword() || !$encoder->isPasswordValid($user->getPassword(), $password, $user->getSalt())) {
            $this->context->addViolation($constraint->message);
        }
    }
-Original file line number
+Diff line change
@@ -42,6 +42,10 @@ public function encodePassword(UserInterface $user, $plainPassword)
          */
         public function isPasswordValid(UserInterface $user, $raw)
         {
+            if (null === $user->getPassword()) {
                   nicolas-grekas marked this conversation as resolved.
              

          
            Show resolved
            Hide resolved
        

                
  
            
  

  
    
  
    
      

              Uh oh!

              
There was an error while loading. Please reload this page.
+                return false;
+            }
             $encoder = $this->encoderFactory->getEncoder($user);
             return $encoder->isPasswordValid($user->getPassword(), $raw, $user->getSalt());
-          Expand Down