From 980fa55846811eeff89f116c49b38b085143c64e Mon Sep 17 00:00:00 2001 From: Neil Alexander Date: Mon, 10 Oct 2022 10:39:29 +0100 Subject: Stronger passwordless account checks (fixes #2780) --- userapi/internal/api.go | 2 ++ 1 file changed, 2 insertions(+) (limited to 'userapi/internal/api.go') diff --git a/userapi/internal/api.go b/userapi/internal/api.go index 591faffd..2f7795df 100644 --- a/userapi/internal/api.go +++ b/userapi/internal/api.go @@ -838,6 +838,8 @@ func (a *UserInternalAPI) QueryAccountByPassword(ctx context.Context, req *api.Q return nil case bcrypt.ErrMismatchedHashAndPassword: // user exists, but password doesn't match return nil + case bcrypt.ErrHashTooShort: // user exists, but probably a passwordless account + return nil default: res.Exists = true res.Account = acc -- cgit v1.2.3