fix: http auth without password throws unintentionally
Massimo Melina committed
Jul 31, 2022 at 16:20 UTC
299e48c2109c74f2df50052e5e2bdf32fe0744d5
1 file changed
+1
-1
server/src/middlewares.ts
+1
-1
@@ -139,7 +139,7 @@ async function getHttpAccount(ctx: Koa.Context) {
139
async function srpCheck(username: string, password: string) {
140
username = username.toLocaleLowerCase()
141
const account = getAccount(username)
142
- if (!account?.srp) return false
142
+ if (!account?.srp || !password) return false
143
const { step1, salt, pubKey } = await srpStep1(account)
144
const client = new SRPClientSession(new SRPRoutines(new SRPParameters()))
145
const clientRes1 = await client.step1(username, password)