chore: enusre old password not blank

halo-dev · Apr 19, 2024 · 267701d · 267701d
1 parent db3b415
commit 267701d
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/application/src/main/java/run/halo/app/core/extension/service/UserServiceImpl.java b/application/src/main/java/run/halo/app/core/extension/service/UserServiceImpl.java
@@ -179,12 +179,16 @@ public Mono<User> createUser(User user, Set<String> roleNames) {
 
     @Override
     public Mono<Boolean> confirmPassword(String username, String rawPassword) {
+
         return getUser(username)
             .filter(user -> {
                 if (!StringUtils.hasText(user.getSpec().getPassword())) {
                     // If the password is not set, return true directly.
                     return true;
                 }
+                if (!StringUtils.hasText(rawPassword)) {
+                    return false;
+                }
                 return passwordEncoder.matches(rawPassword, user.getSpec().getPassword());
             })
             .hasElement();