From ff2819278518d09fe3e3a8eed013fa0ddd3a022c Mon Sep 17 00:00:00 2001
From: Hivert Quentin <quentin.hivert.fr@gmail.com>
Date: Mon, 9 Nov 2026 15:29:09 +0100
Subject: [PATCH] fix(login): check that password  is non-empty or null to
 avoid crash

---
 SoObjects/SOGo/SOGoWebAuthenticator.m | 5 +++++
 UI/MainUI/SOGoRootPage.m              | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/SoObjects/SOGo/SOGoWebAuthenticator.m b/SoObjects/SOGo/SOGoWebAuthenticator.m
index 84929f8d0..401391082 100644
--- a/SoObjects/SOGo/SOGoWebAuthenticator.m
+++ b/SoObjects/SOGo/SOGoWebAuthenticator.m
@@ -148,6 +148,11 @@
     return NO;
   if(_login && [_login length] == 0)
     return NO;
+  
+  if(!_pwd)
+    return NO;
+  if(_pwd && [_pwd length] == 0)
+    return NO;
 
   loginDomain = nil;
   if(*_domain == nil || [*_domain length] == 0)
diff --git a/UI/MainUI/SOGoRootPage.m b/UI/MainUI/SOGoRootPage.m
index 5fbe2b042..27b654d84 100644
--- a/UI/MainUI/SOGoRootPage.m
+++ b/UI/MainUI/SOGoRootPage.m
@@ -1218,7 +1218,7 @@ static const NSString *kJwtKey = @"jwt";
      response = [self responseWithStatus: 403
                               andString: @"Missing 'oldPassword' parameter"];
     }
-  else if (!newPassword)
+  else if (!newPassword || (newPassword && [newPassword length] == 0))
     {
      response = [self responseWithStatus: 403
                               andString: @"Missing 'newPassword' parameter"];