Skip to content

Commit

Permalink
fix(auth): Disallow Falsy credentials
Browse files Browse the repository at this point in the history
Allowing Falsy auth credentials will cause problems later, for example in `hmac.compare_digest(input_password.encode(), correct_password.encode())` as NoneType has no `encode` method. Moreover, allowing empty passwords would make no sense from a security point of view.
  • Loading branch information
Paillat-dev committed Jul 2, 2024
1 parent 9e0d677 commit 123f771
Showing 1 changed file with 13 additions and 0 deletions.
13 changes: 13 additions & 0 deletions gradio/blocks.py
Original file line number Diff line number Diff line change
Expand Up @@ -2230,6 +2230,19 @@ def reverse(text):
self.auth = [auth]
else:
self.auth = auth

if (
auth
and not callable(self.auth)
and any(
not authenticable[0] or not authenticable[1]
for authenticable in self.auth
)
):
raise ValueError(
"You must provide a username and password for authentication."
)

self.auth_message = auth_message
self.show_error = show_error
self.height = height
Expand Down

0 comments on commit 123f771

Please sign in to comment.