Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bad Request when creating a user without password #30241

Closed
kagmole opened this issue Dec 13, 2021 · 2 comments
Closed

Bad Request when creating a user without password #30241

kagmole opened this issue Dec 13, 2021 · 2 comments
Labels
2. developing Work in progress bug

Comments

@kagmole
Copy link

kagmole commented Dec 13, 2021

How to use GitHub

  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Steps to reproduce

This error only occures if in your password policy (Settings > Security) you have the minimal password length set to 0.

  1. Connect to the web Front-End of NextCloud
  2. Go to: Users > New user
  3. Try to create a user with a login, username and mail but no password

Expected behaviour

A mail is sent to the new user with an invitation to create its password.

Actual behaviour

A Bad Request occures. The error comes from UserManager which does not have a valid password for the account.
It is because the fallback below does not work: the generated password is an empty string and not null.

$passwordEvent = new GenerateSecurePasswordEvent();
$this->eventDispatcher->dispatchTyped($passwordEvent);
$password = $passwordEvent->getPassword();
if ($password === null) {
// Fallback: ensure to pass password_policy in any case
$password = $this->secureRandom->generate(10)
. $this->secureRandom->generate(1, ISecureRandom::CHAR_UPPER)
. $this->secureRandom->generate(1, ISecureRandom::CHAR_LOWER)
. $this->secureRandom->generate(1, ISecureRandom::CHAR_DIGITS)
. $this->secureRandom->generate(1, ISecureRandom::CHAR_SYMBOLS);
}

Adding || $password === '' would fix the issue.
The workaround right now is to configure a greater minimal password length than 0.

@kagmole kagmole added 0. Needs triage Pending check for reproducibility or if it fits our roadmap bug labels Dec 13, 2021
@solracsf
Copy link
Member

Mind to open a pull request?

@szaimen szaimen added 2. developing Work in progress and removed 0. Needs triage Pending check for reproducibility or if it fits our roadmap labels Jan 13, 2022
@szaimen szaimen linked a pull request Jan 13, 2022 that will close this issue
@kagmole
Copy link
Author

kagmole commented Oct 13, 2022

Closing the issue since nextcloud/password_policy#356 fixes it.

@kagmole kagmole closed this as completed Oct 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2. developing Work in progress bug
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants