From 3f20a04b4fdd41f3c0ccbfa53f388bb8bae5e104 Mon Sep 17 00:00:00 2001 From: Steve Bauman Date: Fri, 12 Apr 2024 16:01:07 -0400 Subject: [PATCH 1/3] Don't rehash passwords if password column is false --- src/Auth/DatabaseUserProvider.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/Auth/DatabaseUserProvider.php b/src/Auth/DatabaseUserProvider.php index 12c759f..31a1762 100644 --- a/src/Auth/DatabaseUserProvider.php +++ b/src/Auth/DatabaseUserProvider.php @@ -206,6 +206,8 @@ public function validateCredentials(Authenticatable $user, array $credentials): */ public function rehashPasswordIfRequired(Authenticatable $user, array $credentials, bool $force = false): void { - $this->eloquent->rehashPasswordIfRequired($user, $credentials, $force); + if (($this->synchronizer->getConfig()['password_column'] ?? 'password') === false) { + $this->eloquent->rehashPasswordIfRequired($user, $credentials, $force); + } } } From b989985049aa488fa3c4f0b878e1c27e917d2cd9 Mon Sep 17 00:00:00 2001 From: Steve Bauman Date: Fri, 12 Apr 2024 16:02:38 -0400 Subject: [PATCH 2/3] Fix conditional --- src/Auth/DatabaseUserProvider.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Auth/DatabaseUserProvider.php b/src/Auth/DatabaseUserProvider.php index 31a1762..1c9b9b7 100644 --- a/src/Auth/DatabaseUserProvider.php +++ b/src/Auth/DatabaseUserProvider.php @@ -206,7 +206,7 @@ public function validateCredentials(Authenticatable $user, array $credentials): */ public function rehashPasswordIfRequired(Authenticatable $user, array $credentials, bool $force = false): void { - if (($this->synchronizer->getConfig()['password_column'] ?? 'password') === false) { + if (($this->synchronizer->getConfig()['password_column'] ?? 'password') !== false) { $this->eloquent->rehashPasswordIfRequired($user, $credentials, $force); } } From b1ad38a08e580aa39a420ea4221b35abf76f7cc6 Mon Sep 17 00:00:00 2001 From: Steve Bauman Date: Fri, 12 Apr 2024 16:05:31 -0400 Subject: [PATCH 3/3] Add test --- tests/Feature/DatabaseUserProviderTest.php | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/tests/Feature/DatabaseUserProviderTest.php b/tests/Feature/DatabaseUserProviderTest.php index beba034..38d2006 100644 --- a/tests/Feature/DatabaseUserProviderTest.php +++ b/tests/Feature/DatabaseUserProviderTest.php @@ -159,4 +159,17 @@ public function test_failing_loudly_throws_exception_when_resolving_users() $provider->retrieveByCredentials([]); } + + public function test_rehash_password_if_required_does_nothing_when_password_column_disabled() + { + $synchronizer = new UserSynchronizer(TestUserModelStub::class, [ + 'password_column' => false, + ]); + + $provider = $this->createDatabaseUserProvider(synchronizer: $synchronizer); + + $provider->rehashPasswordIfRequired($model = new TestUserModelStub, ['password' => 'secret']); + + $this->assertNull($model->password); + } }