Validate the password before generating an apptoken

Signed-off-by: Joas Schilling <coding@schilljs.com>

diff --git a/core/Command/User/AddAppPassword.php b/core/Command/User/AddAppPassword.php
index 34c8dc67ccc3337d14b184964d2974d2fbb3339b..4f636c406fbaa6f8c1c14a42ad337b3d32b43f12 100644 (file)
--- a/core/Command/User/AddAppPassword.php
+++ b/core/Command/User/AddAppPassword.php
@@ -109,8 +109,10 @@ class AddAppPassword extends Command {
                        return 1;
                }
 
-               $output->writeln('<info>The password is not validated so what you provide is what gets recorded in the token</info>');
-
+               if (!$this->userManager->checkPassword($user->getUID(), $password)) {
+                       $output->writeln('<error>The provided password is invalid</error>');
+                       return 1;
+               }
 
                $token = $this->random->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
                $generatedToken = $this->tokenProvider->generateToken(