From 071ec7f8c41353df57eed44a59c8ff1dceb44902 Mon Sep 17 00:00:00 2001 From: "Hubert Van de Walle (huvw)" Date: Fri, 5 May 2023 12:59:09 +0000 Subject: [PATCH] [FIX] auth_password_policy: prevent crash when emptying password input Steps to reproduce ================== - Go to /web/signup - In the password field, type something - Clear the input Cause of the issue ================== A bunch of conditions evaluates to NaN inside `ConcretePolicy.score(password)` when passing en empty string as a parameter. Solution ======== An empty password should always have a score of 0 anyway, so we can do an early return. (The lengthscore would be 0, and we multiply by it at the end) opw-3269555 closes odoo/odoo#120711 X-original-commit: 6aa16bb740af14fcebd8f05bdc19c9e8879d77ed Signed-off-by: Vranckx Florian (flvr) --- addons/auth_password_policy/static/src/password_policy.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/addons/auth_password_policy/static/src/password_policy.js b/addons/auth_password_policy/static/src/password_policy.js index 8d3b6b8f22a..f90643f257d 100644 --- a/addons/auth_password_policy/static/src/password_policy.js +++ b/addons/auth_password_policy/static/src/password_policy.js @@ -39,6 +39,9 @@ export class ConcretePolicy extends Policy { } score(password) { + if (!password) { + return 0; + } const lengthscore = Math.min(password.length / this.minlength, 1.0); // we want the number of "words". Splitting on no-words doesn't work // because JS will add an empty string when matching a leading or