github-featured / infiniflow--ragflow

发布

0 发布 98 Git 标签

RSS 订阅源
  • dev-20260715 5cf95d2c0f
    比较

    Fix: admin password update crashes for SSO users (500 'NoneType' object has no attribute 'split') (#16914)

    frostbyte_neo 发布于 2026-07-14 15:30:35 +00:00

    What problem does this PR solve?

    Setting a password from the admin panel for an SSO-provisioned account
    (OIDC/OAuth/GitHub) returns a 500 with:

    'NoneType' object has no attribute 'split'

    Root cause — SSO-provisioned accounts have no local password, so
    usr.password is None (the User.password column is null=True). In
    UserMgr.update_user_password (admin/server/services.py), the "same
    password" optimization calls:

    if check_password_hash(usr.password, psw):

    werkzeug.security.check_password_hash(None, psw) internally does
    pwhash.split("$"), which raises AttributeError: 'NoneType' object has no attribute 'split' → surfaced as a 500.

    Repro

    1. Configure an SSO channel (OIDC/OAuth) under oauth in the service
      config.
    2. Log in once via SSO so the account is auto-provisioned (created
      without a local password).
    3. In the admin panel, set/change that user's password.
    4. → 500 'NoneType' object has no attribute 'split'.

    Fix — guard the equality check with usr.password. A passwordless
    (SSO) user skips the comparison and goes straight to setting the new
    password, which is the desired behavior (it gives them a password
    fallback in addition to SSO).

    Type of change

    • Bug Fix (non-breaking change which fixes an issue)

    Co-authored-by: Claude Opus 4.8 (1M context) noreply@anthropic.com

    下载附件