diff options
| author | Zach Copley <zach@status.net> | 2010-03-10 03:39:05 +0000 |
|---|---|---|
| committer | Zach Copley <zach@status.net> | 2010-03-10 09:57:00 -0800 |
| commit | 55e8473a7a87ebe85bcfa5cfb409ce9a9aeafdd0 (patch) | |
| tree | 121d2d4be71fa4532455f5a86e5004c19c28fe7f | |
| parent | 8ee8b89dd8b3483724aa52a812eef89b8bfae38b (diff) | |
A blank username should never be allowed.
| -rw-r--r-- | lib/apiauth.php | 2 | ||||
| -rw-r--r-- | lib/util.php | 5 |
2 files changed, 6 insertions, 1 deletions
diff --git a/lib/apiauth.php b/lib/apiauth.php index f63c84d8f..32502399f 100644 --- a/lib/apiauth.php +++ b/lib/apiauth.php @@ -241,7 +241,7 @@ class ApiAuthAction extends ApiAction $realm = common_config('site', 'name') . ' API'; } - if (!isset($this->auth_user_nickname) && $required) { + if (empty($this->auth_user_nickname) && $required) { header('WWW-Authenticate: Basic realm="' . $realm . '"'); // show error if the user clicks 'cancel' diff --git a/lib/util.php b/lib/util.php index da2799d4f..5bef88ecc 100644 --- a/lib/util.php +++ b/lib/util.php @@ -133,6 +133,11 @@ function common_munge_password($password, $id) function common_check_user($nickname, $password) { + // empty nickname always unacceptable + if (empty($nickname)) { + return false; + } + $authenticatedUser = false; if (Event::handle('StartCheckPassword', array($nickname, $password, &$authenticatedUser))) { |