Be sure not to use blank passwords as the password

dgtlmoon · Jun 21, 2021 · 45bd454 · 45bd454
1 parent a429223
commit 45bd454
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 5 deletions.
diff --git a/backend/__init__.py b/backend/__init__.py
@@ -483,7 +483,10 @@ def settings_page():
                 flash("Password protection enabled.", 'notice')
                 flask_login.logout_user()
                 return redirect(url_for('index'))
-
+            else:
+                # Unset it anyway, just to be sure.
+                datastore.data['settings']['application']['password'] = False
+
             flash("Settings updated.")
 
         if request.method == 'POST' and not form.validate():

diff --git a/backend/forms.py b/backend/forms.py
@@ -46,11 +46,12 @@ def build_password(self, password):
     # incoming
     def process_formdata(self, valuelist):
         if valuelist:
-            # Remove empty strings
-            self.encrypted_password = self.build_password(valuelist[0])
-            self.data = []
+            # Be really sure it's non-zero in length
+            if len(valuelist[0].strip()) > 0:
+                self.encrypted_password = self.build_password(valuelist[0])
+                self.data = ""
         else:
-            self.data = []
+            self.data = False
 
 
 # Separated by  key:value