From 4fd1b1001847eaef73b3da9a222c011068a3b2b7 Mon Sep 17 00:00:00 2001 From: Pascal de Bruijn Date: Tue, 6 Sep 2022 15:31:43 +0200 Subject: [PATCH] models/user.py: properly guard plain_text_password property Resolves the following issue, which occurs with force_otp enabled and OAuth authentication sources: File "/srv/powerdnsadmin/powerdnsadmin/models/user.py", line 481, in update_profile "utf-8") if self.plain_text_password else user.password AttributeError: 'User' object has no attribute 'plain_text_password' --- powerdnsadmin/models/user.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/powerdnsadmin/models/user.py b/powerdnsadmin/models/user.py index 2f8b87c..1ac7b60 100644 --- a/powerdnsadmin/models/user.py +++ b/powerdnsadmin/models/user.py @@ -107,7 +107,7 @@ class User(db.Model): def check_password(self, hashed_password): # Check hashed password. Using bcrypt, the salt is saved into the hash itself - if (self.plain_text_password): + if hasattr(self, "plain_text_password"): return bcrypt.checkpw(self.plain_text_password.encode('utf-8'), hashed_password.encode('utf-8')) return False @@ -423,7 +423,7 @@ class User(db.Model): name='Administrator').first().id self.password = self.get_hashed_password( - self.plain_text_password) if self.plain_text_password else '*' + self.plain_text_password) if hasattr(self, "plain_text_password") else '*' if self.password and self.password != '*': self.password = self.password.decode("utf-8") @@ -459,7 +459,7 @@ class User(db.Model): user.email = self.email # store new password hash (only if changed) - if self.plain_text_password: + if hasattr(self, "plain_text_password"): user.password = self.get_hashed_password( self.plain_text_password).decode("utf-8") @@ -478,7 +478,7 @@ class User(db.Model): user.lastname = self.lastname if self.lastname else user.lastname user.password = self.get_hashed_password( self.plain_text_password).decode( - "utf-8") if self.plain_text_password else user.password + "utf-8") if hasattr(self, "plain_text_password") else user.password if self.email: # Can not update to a new email that