[Security] Check UserInterface::getPassword is not null before calling needsRehash

dbrekelmans · chalasr · commit 8e4cf497cd74 · 2019-12-06T21:36:15.000+01:00
diff --git a/src/Symfony/Component/Security/Core/Encoder/UserPasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/UserPasswordEncoder.php
@@ -56,6 +56,10 @@ public function isPasswordValid(UserInterface $user, $raw)
      */
     public function needsRehash(UserInterface $user): bool
     {
+        if (null === $user->getPassword()) {
+            return false;
+        }
+
         $encoder = $this->encoderFactory->getEncoder($user);
 
         return method_exists($encoder, 'needsRehash') && $encoder->needsRehash($user->getPassword());
