Merge pull request #419 from rruchte/auth-ambiguous-identity-fix

Add check in DbTable Authentication Adapter for empty results when AmbiguityIdentity is TRUE
Shardj · Jul 22, 2024 · 5ca64ea · 5ca64ea
2 parents be808f8 + f9bc749
commit 5ca64ea
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/library/Zend/Auth/Adapter/DbTable.php b/library/Zend/Auth/Adapter/DbTable.php
@@ -527,8 +527,12 @@ protected function _authenticateValidateResultSet(array $resultIdentities)
     protected function _authenticateValidateResult($resultIdentity)
     {
         $zendAuthCredentialMatchColumn = $this->_zendDb->foldCase('zend_auth_credential_match');
-
-        if ($resultIdentity[$zendAuthCredentialMatchColumn] != '1') {
+
+        if (empty($resultIdentity)) {
+            $this->_authenticateResultInfo['code'] = Zend_Auth_Result::FAILURE_IDENTITY_NOT_FOUND;
+            $this->_authenticateResultInfo['messages'][] = 'A record with the supplied identity could not be found.';
+            return $this->_authenticateCreateAuthResult();
+        } elseif ($resultIdentity[$zendAuthCredentialMatchColumn] != '1') {
             $this->_authenticateResultInfo['code'] = Zend_Auth_Result::FAILURE_CREDENTIAL_INVALID;
             $this->_authenticateResultInfo['messages'][] = 'Supplied credential is invalid.';
             return $this->_authenticateCreateAuthResult();