fixed #129 - auth bypass when user.require is not set

warp-tech · Jun 10, 2022 · d771fa0 · d771fa0
1 parent 89e93c1
commit d771fa0
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/warpgate-common/src/config_providers/file.rs b/warpgate-common/src/config_providers/file.rs
@@ -186,11 +186,13 @@ impl ConfigProvider for FileConfigProvider {
                     return Ok(AuthResult::Rejected);
                 }
             }
-            None => {
-                return Ok(AuthResult::Accepted {
+            None => Ok(if !valid_credentials.is_empty() {
+                AuthResult::Accepted {
                     username: user.username.clone(),
-                })
-            }
+                }
+            } else {
+                AuthResult::Rejected
+            }),
         }
     }