PlaintextPasswordEncoder ignores null encoded passwords
Fixes gh-7023
This commit is contained in:
@@ -51,6 +51,9 @@ public class PlaintextPasswordEncoder extends BasePasswordEncoder {
|
||||
}
|
||||
|
||||
public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
|
||||
if (encPass == null) {
|
||||
return false;
|
||||
}
|
||||
String pass1 = encPass + "";
|
||||
|
||||
// Strict delimiters is false because pass2 never persisted anywhere
|
||||
|
||||
Reference in New Issue
Block a user