From 0593170281e8215836ab872b1451e851f15246d9 Mon Sep 17 00:00:00 2001 From: matresstester Date: Fri, 9 May 2014 16:09:42 -0700 Subject: Handle blank passwords This is because the entire req.body was fed into redis. It's hacky but I'm deleting the whole password value pair before req.body get fed. Also checked changed the password blank check into an existential check --- routes/users.coffee | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/routes/users.coffee b/routes/users.coffee index 1113a4e4..687365c1 100644 --- a/routes/users.coffee +++ b/routes/users.coffee @@ -86,8 +86,10 @@ module.exports = (sessions) -> update: (req, res) -> return unless req.params.user is req.user.username or req.user.username is 'admin' or req.user.username is 'ben' + if req.body.password is '' + delete req.body.password db.hmset("user:"+req.params.user, req.body, -> - if req.body.password is '' + if not req.body.password? res.redirect("/#{req.params.user}") else bcrypt.hash(req.body.password, 12, (err, hash) -> -- cgit v1.2.3