From 0f295ababacfefc217053a3093c520970bc72296 Mon Sep 17 00:00:00 2001
From: zeripath <art27@cantab.net>
Date: Wed, 30 Jan 2019 21:18:54 +0000
Subject: [PATCH] Only allow local login if password is non-empty (#5906)

---
 models/login_source.go | 2 +-
 modules/lfs/server.go  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/models/login_source.go b/models/login_source.go
index 25c7aa312..46bf3a5e3 100644
--- a/models/login_source.go
+++ b/models/login_source.go
@@ -644,7 +644,7 @@ func UserSignIn(username, password string) (*User, error) {
 	if hasUser {
 		switch user.LoginType {
 		case LoginNoType, LoginPlain, LoginOAuth2:
-			if user.ValidatePassword(password) {
+			if user.IsPasswordSet() && user.ValidatePassword(password) {
 				return user, nil
 			}
 
diff --git a/modules/lfs/server.go b/modules/lfs/server.go
index f0f2d4bf4..58acbb807 100644
--- a/modules/lfs/server.go
+++ b/modules/lfs/server.go
@@ -582,7 +582,7 @@ func parseToken(authorization string) (*models.User, *models.Repository, string,
 		if err != nil {
 			return nil, nil, "basic", err
 		}
-		if !u.ValidatePassword(password) {
+		if !u.IsPasswordSet() || !u.ValidatePassword(password) {
 			return nil, nil, "basic", fmt.Errorf("Basic auth failed")
 		}
 		return u, nil, "basic", nil