EZP-29704: Passwordless login for LDAP users

ezsystems · Oct 31, 2018 · 13f03a2 · 13f03a2
1 parent a26004b
commit 13f03a2
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/kernel/classes/datatypes/ezuser/ezuser.php b/kernel/classes/datatypes/ezuser/ezuser.php
@@ -783,6 +783,11 @@ protected static function loginFailed( $userID = false, $login )
      */
     protected static function _loginUser( $login, $password, $authenticationMatch = false )
     {
+        if ( $login == '' || $password == '' )
+        {
+            return false;
+        }
+
         $http = eZHTTPTool::instance();
         $db = eZDB::instance();
 
@@ -821,6 +826,7 @@ protected static function _loginUser( $login, $password, $authenticationMatch =
                       WHERE ( $loginText ) AND
                         ezcontentobject.status='$contentObjectStatus' AND
                         ezcontentobject.id=contentobject_id AND
+                        password_hash_type!=0 AND
                         ( ( password_hash_type!=4 ) OR
                           ( password_hash_type=4 AND
                             password_hash=PASSWORD('$passwordEscaped') ) )";
@@ -831,6 +837,7 @@ protected static function _loginUser( $login, $password, $authenticationMatch =
                              password_hash_type, email, login
                       FROM   ezuser, ezcontentobject
                       WHERE  ( $loginText )
+                      AND    password_hash_type!=0
                       AND    ezcontentobject.status='$contentObjectStatus'
                       AND    ezcontentobject.id=contentobject_id";
         }