Fix 0013901: SOAP API allows invoking methods without proper authenti…

…cation Note: only applied to 1.2.x not 'next', as the code is changing anyway
mantisbt · Feb 16, 2012 · f5106be · f5106be
1 parent 069239e
commit f5106be
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/api/soap/mc_api.php b/api/soap/mc_api.php
@@ -51,6 +51,11 @@ function mci_check_login( $p_username, $p_password ) {
 
 		# do not use password validation.
 		$p_password = null;
+	} else {
+		if( is_blank( $p_password ) ) {
+			# require password for authenticated access
+			return false;
+		}
 	}
 
 	if( false === auth_attempt_script_login( $p_username, $p_password ) ) {