[Security] fix check for empty usernames

Author: xabbuh

Authentication/Provider/UserAuthenticationProvider.php

@@ -62,7 +62,7 @@ public function authenticate(TokenInterface $token)
         }
 
         $username = $token->getUsername();
-        if (empty($username)) {
+        if ('' === $username || null === $username) {
             $username = 'NONE_PROVIDED';
         }
 

Authentication/RememberMe/PersistentToken.php

@@ -40,7 +40,7 @@ public function __construct($class, $username, $series, $tokenValue, \DateTime $
         if (empty($class)) {
             throw new \InvalidArgumentException('$class must not be empty.');
         }
-        if (empty($username)) {
+        if ('' === $username || null === $username) {
             throw new \InvalidArgumentException('$username must not be empty.');
         }
         if (empty($series)) {

User/User.php

@@ -30,7 +30,7 @@ final class User implements AdvancedUserInterface
 
     public function __construct($username, $password, array $roles = array(), $enabled = true, $userNonExpired = true, $credentialsNonExpired = true, $userNonLocked = true)
     {
-        if (empty($username)) {
+        if ('' === $username || null === $username) {
             throw new \InvalidArgumentException('The username cannot be empty.');
         }