never allow blank passwords

darcs-hash:20080825185245-84dde-f2ad86c1aedc2a42f7b468775234be53a7e84d5b.gz

diff --git a/lib/util.php b/lib/util.php
index efd86ad509e12fc386c4b306409c2c3952eb9e4a..e14cc36aced85fec86ac35dd6aac3fe55a6c444f 100644 (file)
--- a/lib/util.php
+++ b/lib/util.php
@@ -493,6 +493,10 @@ function common_munge_password($password, $id) {
 
 # check if a username exists and has matching password
 function common_check_user($nickname, $password) {
+       # NEVER allow blank passwords, even if they match the DB
+       if (mb_strlen($password) == 0) {
+               return false;
+       }
        $user = User::staticGet('nickname', $nickname);
        if (is_null($user)) {
                return false;