moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-09 10:56:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-80064 authentication: password can be null

Browse source 
The Open ID Connect plugin uses null for the password,
which makes the internal password update fail to proceed.
Allowing null resolved the problem.

As a note, there is a potential issue if the authentication method has
a false return for the prevent_local_password because it will trigger
the hash_internal_user_password() where  the $password can not be null.
Since this only addresses the oauth2 issue, we should ignore it.
This commit is contained in:
meirzamoodle 2024-07-27 04:27:46 +07:00
parent 1a33da6637
commit 2bd774d432
2 changed files with 28 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/moodlelib.php
View file

@ -4360,7 +4360,7 @@ function hash_internal_user_password(#[\SensitiveParameter] string $password, $f
* It will remove Web Services user tokens too.
*
* @param stdClass $user User object (password property may be updated).
* @param string $password Plain text password.
* @param string|null $password Plain text password.
* @param bool $fasthash If true, use a low cost factor when generating the hash
* This is much faster to generate but makes the hash
* less secure. It is used when lots of hashes need to
@ -4369,7 +4369,7 @@ function hash_internal_user_password(#[\SensitiveParameter] string $password, $f
*/
function update_internal_user_password(
stdClass $user,
#[\SensitiveParameter] string $password,
#[\SensitiveParameter] ?string $password,
bool $fasthash = false
): bool {
global $CFG, $DB;