do not allow empty passwords

diff --git a/api.php b/api.php
index ac49d76665ca7cec11da77cad84d1b03c3bc3181..e74f3b46ff1e0d873f486053ae8f47f0aa157bbb 100644 (file)
--- a/api.php
+++ b/api.php
@@ -344,6 +344,9 @@ function main ($con) {
             try {
                 $con->setpwd ($user, $newpass);
             } catch (Exception $e) {
+                if ($e->getMessage () == anydbConnection::err_query) {
+                    error_request ();
+                }
                 error_server ();
             }
             setcookies ($user, $newpass);
@@ -364,6 +367,9 @@ function main ($con) {
             try {
                 $con->setpwd ($newuser_name, $newuser_password);
             } catch (Exception $e) {
+                if ($e->getMessage () == anydbConnection::err_query) {
+                    error_request ();
+                }
                 error_server ();
             }
             success_newuser ($newuser_name);

diff --git a/inc/db/anydb.php b/inc/db/anydb.php
index 1094365eb42a6201d99bdd0e851427d096e60977..b63a26400208ceafbc79ee9e5af2f630a60f2495 100644 (file)
--- a/inc/db/anydb.php
+++ b/inc/db/anydb.php
@@ -100,7 +100,8 @@ interface anydbConnection {
 
     /*
      * set password $pwd for user $usrname. If $usrname does not exist, create
-     * it
+     * it.
+     * throws an err_query error in case $pwd is null
      */
     public function setpwd($usrname, $pwd);
 

diff --git a/inc/db/mysql.php b/inc/db/mysql.php
index 8c07aa3de81c304922b7376d6d266ef13b9ca2c8..83836074c05a219b4cc8b033d1b9afe6c5ec573a 100644 (file)
--- a/inc/db/mysql.php
+++ b/inc/db/mysql.php
@@ -63,6 +63,9 @@ class mysqlConnection implements anydbConnection {
     }
 
     public function setpwd ($user_name, $pwd) {
+        if (strlen ($pwd) == 0) {
+            throw new Exception (anydbConnection::err_query);
+        }
         $usrname_escaped = mysql_real_escape_string ($user_name);
         if ($this->user_exists ($user_name)) {
             $query = sprintf ("UPDATE %susers SET pwd='%s' WHERE name like '%s';", 

diff --git a/inc/html/admin.php b/inc/html/admin.php
index 7702b949b7408fd720eaf0f140b042af2e7e3fb1..d6d876b105aa570631c4e02cff7105d9ba60d569 100644 (file)
--- a/inc/html/admin.php
+++ b/inc/html/admin.php
@@ -69,6 +69,7 @@ if (!$usrtblexists || !$itemstblexists) {
             UnconsistentError: "<?php ptrans('Server reply was inconsistent.')?>",
             DelSucces: "<?php ptrans('Removal took place correctly.')?>",
             UpdateSucces: "<?php ptrans('Save took place correctly.')?>",
+            emptyPasswordError: "<?php ptrans('Password cannot be empty')?>",
             userPasswordmatchError: "<?php ptrans('Passwords do not match.')?>",
             changeSamePass: "<?php ptrans('New password is the same as old password.')?>",
             changePassBadPass: "<?php ptrans('Bad password.')?>",

diff --git a/inc/html/install.php b/inc/html/install.php
index d3def31fe5b96dbb7273298cb98f7ac777e2e65c..4b2d02cb3673dca4cc1a1a53d096015f807cce6b 100644 (file)
--- a/inc/html/install.php
+++ b/inc/html/install.php
@@ -10,6 +10,10 @@
       <link rel="stylesheet" href="./media/install.css" type="text/css" >
       <title><?php ptrans ('SYP wizard')?></title>
       <script type="text/javascript">
+      var sypStrings = {
+            emptyPasswordError: "<?php ptrans('Password cannot be empty')?>"
+      };
+
       function init () {
         if (document.getElementById('db_host')) { 
             document.getElementById('db_host').focus();
@@ -19,6 +23,17 @@
             document.getElementById('admin_pass').select();
         }
       }
+
+      function checkpwd () {
+          var pass = document.getElementById('admin_pass').value;
+          if (!pass) {
+              document.getElementById('empty_pass_error').innerHTML = sypStrings.emptyPasswordError;
+              document.getElementById('empty_pass_error').style.display = "block";
+              document.getElementById('admin_pass').focus();
+              return false;
+          }
+          return true;
+      }
       </script>
 </head>
 <body onload="init()">
@@ -192,7 +207,8 @@
     if ($users_table_exists) {
         par_success (trans ('Found user table.'));
     } else {
-        if (isset($_POST ["admin_pass"])) {
+        $empty_pass = (isset ($_POST ["admin_pass"]) && (strlen ($_POST ["admin_pass"]) == 0));
+        if ($_POST ["admin_pass"]) {
             try {
                 $connection->create_users_table (true);
             } catch (Exception $e) {
@@ -207,11 +223,15 @@
             par_success (trans ('Admin password initialized.'));
 
         } else {
-            print ('<form class="center" method="post" action="">
+            print ('<form class="center" method="post" action="" onsubmit="return checkpwd()">
                     <label for="admin_pass">' . trans ("choose admin password") . '</label>
-                    <input id="admin_pass" name="admin_pass" type="password">
-                    <input type="submit">
-                 </form>');
+                    <input id="admin_pass" name="admin_pass" type="password">');
+            if ($empty_pass) {
+                print ('<p class="error" id="empty_pass_error">' . trans('Password cannot be empty') . '</p>');
+            } else {
+                print ('<p class="error" style="display: none" id="empty_pass_error"></p>');
+            }
+            print ('<br><input type="submit"></form>');
             leave ();
         }
     }

diff --git a/inc/i10n/en/syp.php b/inc/i10n/en/syp.php
index 316158b9d60a1953e63fd6b49bf6f398c025d97d..de65072d0325ea8171070039e2312baca50715db 100644 (file)
--- a/inc/i10n/en/syp.php
+++ b/inc/i10n/en/syp.php
@@ -17,6 +17,9 @@
         "SYP wizard"
           => "",
 
+        "Password cannot be empty"
+          => "",
+
         "exist but is not a directory"
           => "",
 

diff --git a/inc/i10n/fr/syp.php b/inc/i10n/fr/syp.php
index 1cb36008c66be9e2640154dcdc72164bf25cca62..d4240b5a0e0266af0d4888d54ab1c9d029b12cd3 100644 (file)
--- a/inc/i10n/fr/syp.php
+++ b/inc/i10n/fr/syp.php
@@ -18,6 +18,11 @@
         "Assistant d'installation de SYP"
           ,
 
+        "Password cannot be empty"
+          =>
+        "Le mot de passe ne peut pas être vide"
+          ,
+
         "exist but is not a directory"
           =>
         "existe mais n'est pas un répertoire"

diff --git a/js/admin.js b/js/admin.js
index 85a28ddca09ee94712d9ba3e547bd01a6745a30f..36c74069397145bde8909b5116ea1d529a62c6fc 100644 (file)
--- a/js/admin.js
+++ b/js/admin.js
@@ -923,6 +923,12 @@ var userMgr = {
             return;
         }
 
+        if (!newpass) {
+            this.commError(SypStrings.emptyPasswordError);
+            $("#pass_new").focus().select();
+            return;
+        }
+
         var curpass = $("#pass_current").val();
         if (newpass == curpass) {
             this.commError(SypStrings.changeSamePass);
@@ -1008,6 +1014,12 @@ var userMgr = {
             return;
         }
 
+        if (!newuser_pass) {
+            this.commError(SypStrings.emptyPasswordError);
+            $("#pass_new").focus().select();
+            return;
+        }
+
         this.commError("");
 
         AjaxMgr.add({