Skip to content

[Security] PlainTextPasswordEncoder::isPasswordValid() throws an exception when the user has no password set (password is null) #35040

Closed
@ammoushbib

Description

@ammoushbib

Symfony version(s) affected: 4.4

Description
Actually PlainTextPasswordEnocder::isPasswordValid() throws an exception when the user has no password set (password is null)

How to reproduce

When UserInterface::password is null and the encoder is PlainTextPasswordEncoder an exception is thrown
image

Possible Solution

I think PlainTextPasswordEnocder::isPasswordValid() should return false when the user's password is null.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions