fix(authentication): Handle null or empty string password hash

This can happen when the auth.storeCryptedPassword config is used, which previously errored with: Hasher::verify(): Argument nextcloud#2 ($hash) must be of type string, null given Signed-off-by: Joas Schilling <[email protected]>
summersab · Jun 26, 2023 · 7bad8df · 7bad8df
1 parent ca20811
commit 7bad8df
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/private/Authentication/Token/PublicKeyTokenProvider.php b/lib/private/Authentication/Token/PublicKeyTokenProvider.php
@@ -113,7 +113,7 @@ public function generateToken(string $token,
 		// We need to check against one old token to see if there is a password
 		// hash that we can reuse for detecting outdated passwords
 		$randomOldToken = $this->mapper->getFirstTokenForUser($uid);
-		$oldTokenMatches = $randomOldToken && $this->hasher->verify(sha1($password) . $password, $randomOldToken->getPasswordHash());
+		$oldTokenMatches = $randomOldToken && $randomOldToken->getPasswordHash() && $this->hasher->verify(sha1($password) . $password, $randomOldToken->getPasswordHash());
 
 		$dbToken = $this->newToken($token, $uid, $loginName, $password, $name, $type, $remember);