Ticket #638: 10910_improved_auth_security.patch

repository/server/src/java/org/outerj/daisy/authentication/impl/UserAuthenticatorImpl.java

@@ -89 +89 @@
 
     public AuthenticatedUser authenticate(Credentials credentials) throws RepositoryException {
 
+        if(credentials.getLogin() == null || credentials.getLogin().trim().length() == 0) {
+            throw new AuthenticationException("Refusing to authenticate user with empty login");
+        }
+        
+        if(credentials.getPassword() == null || credentials.getPassword().trim().length() == 0) {
+            throw new AuthenticationException("Refusing to authenticate user without password");
+        }
+
         // Handle the special case of the user $system
         if (credentials.getLogin().equals("$system")) {
             throw new AuthenticationException("User $system is an internally used user that can not log in.");