Skip to content

fix(auth): allow zero string credentials - #810

Merged
stevebauman merged 1 commit into
DirectoryTree:masterfrom
tbasten:fix/zero-password-auth-attempt
Sep 10, 2026
Merged

fix(auth): allow zero string credentials#810
stevebauman merged 1 commit into
DirectoryTree:masterfrom
tbasten:fix/zero-password-auth-attempt

Conversation

@tbasten

@tbasten tbasten commented Sep 10, 2026

Copy link
Copy Markdown

Summary

Fixes authentication credential validation so string "0" is treated as a valid non-empty username or password.

Previously Guard::attempt() used PHP empty() checks. In PHP, empty("0") === true, so a password or username of "0" incorrectly triggered UsernameRequiredException / PasswordRequiredException instead of attempting LDAP bind.

Changes

  • Replace empty($username) with $username === ''
  • Replace empty($password) with $password === ''
  • Add regression coverage for:
    • password "0"
    • username "0"

Why

A zero 0 string is not an empty credential. Applications using validation rules such as Laravel’s required|string accept "0" as present, but LdapRecord rejected it as missing. This caused valid input to be treated as absent before LDAP bind was attempted.

Validation

  • ./vendor/bin/phpunit --filter='test_attempt_allows_zero_string'
  • ./vendor/bin/phpunit tests/Unit/Auth/GuardTest.php
  • ./vendor/bin/pint --dirty

Targeted auth tests pass. Full suite was not run locally because the PHP LDAP extension/constants are unavailable in my local environment.

Copilot AI lite review requested due to automatic review settings September 10, 2026 01:46

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The change precisely addresses PHP empty("0") behavior and includes targeted regression tests for both username and password cases.

Pull request overview

This PR fixes LDAP authentication credential validation so the string "0" is treated as a valid (non-empty) username/password, avoiding PHP empty() semantics that incorrectly classify "0" as empty.

Changes:

  • Update Guard::attempt() to validate credentials with strict empty-string checks (=== '') instead of empty().
  • Add unit-test regression coverage for "0" username and "0" password in GuardTest.
File summaries
File Description
src/Auth/Guard.php Adjusts credential validation to accept "0" as a valid string and proceed to bind.
tests/Unit/Auth/GuardTest.php Adds regression tests ensuring "0" credentials are accepted and binding proceeds as expected.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@stevebauman
stevebauman merged commit afb2485 into DirectoryTree:master Sep 10, 2026
@stevebauman

Copy link
Copy Markdown
Member

Thanks @tbasten! Created release v4.0.7 with this patch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants