This method is also causing us huge issues when used in combination with loopback-component-passport. We had to revert our production servers back to our old setup after a surge of (crashing) errors in this method from our live users using oauth.

Seems like it tries to set password when oauth is being used. Since no password is given and no password is required in this situation why isn't there a check here for existence and type of string?

@ritch Would you be open to a PR. This is blocking for us from moving forward with loopback.

something like this:

UserModel.setter.password = function(plain) {
      if (!plain) {
         return;
      }

      // for the issue above
      plain = '' + plain;
      if (plain.indexOf('$2a$') === 0 && plain.length === 60) {
        // The password is already hashed. It can be the case
        // when the instance is loaded from DB
        this.$password = plain;
      } else {
        this.$password = this.constructor.hashPassword(plain);
      }
};

cc @QuincyLarson @terakilobyte

server break down if password is in numeric form on reset password #1437

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions