Skip to content

config('password.verify', false) not disabling password verification #313

@Serge-45

Description

@Serge-45

Describe the bug

Using Leaf 4.0 / Auth 4.2.1
Disabling the password verification using this line of code as described in the docs (https://leafphp.dev/docs/auth/login.html#password-verification) :
auth()->config('password.verify', false);
This doesn't remove the password verification, and always leads to a wrong password error.

To Reproduce

auth()->config('password.verify', false);
$success = auth()->login(['email'] => 'valid@email']);  // false

Expected behavior

auth()->login() should return true.

Additional context

I think the issue is located in Auth.php, line 295, but not 100% sure :

$passwordIsValid = (Config::get('password.verify') !== false && isset($user[$passwordKey]))
       ? ((is_callable(Config::get('password.verify')))
            ? call_user_func(Config::get('password.verify'), $userPassword, $user[$passwordKey])
            : Password::verify($userPassword, $user[$passwordKey]))
        : false;

The last line should be : true;.

Possible workaround is using a always true function :

config('password.verify', function($pass, $hash) { return true; })

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions