Merge branch '5.0'

* 5.0: (38 commits)
  [Security] Check UserInterface::getPassword is not null before calling needsRehash
  gracefully handle missing event dispatchers
  Fix TokenStorage::reset not called in stateless firewall
  [DotEnv] Remove `usePutEnv` property default value
  [HttpFoundation] get currently session.gc_maxlifetime if ttl doesnt exists
  Set up typo fix
  [DependencyInjection] Handle env var placeholders in CheckTypeDeclarationsPass
  [Cache] fix memory leak when using PhpArrayAdapter
  [Validator] Allow underscore character "_" in URL username and password
  [TwigBridge] Update bootstrap_4_layout.html.twig
  [DoctrineBridge] Removed QueryBuilder type hint in getLoader()
  [FrameworkBundle][SodiumVault] Create secrets directory only when needed
  fix parsing negative octal numbers
  [String] implement __sleep()/__wakeup() on strings
  Fixed translations file dumper behavior
  [Routing][ObjectLoader] Remove forgotten deprecation after merge
  [SecurityBundle] Passwords are not encoded when algorithm set to \"true\"
  [DependencyInjection] Resolve expressions in CheckTypeDeclarationsPass
  [SecurityBundle] Properly escape regex in AddSessionDomainConstraintPass
  do not validate passwords when the hash is null
  ...

Author: nicolas-grekas

Authentication/Provider/DaoAuthenticationProvider.php

@@ -55,6 +55,10 @@ protected function checkAuthentication(UserInterface $user, UsernamePasswordToke
                 throw new BadCredentialsException('The presented password cannot be empty.');
             }
 
+            if (null === $user->getPassword()) {
+                throw new BadCredentialsException('The presented password is invalid.');
+            }
+
             $encoder = $this->encoderFactory->getEncoder($user);
 
             if (!$encoder->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) {

Encoder/UserPasswordEncoder.php

@@ -42,6 +42,10 @@ public function encodePassword(UserInterface $user, string $plainPassword)
      */
     public function isPasswordValid(UserInterface $user, string $raw)
     {
+        if (null === $user->getPassword()) {
+            return false;
+        }
+
         $encoder = $this->encoderFactory->getEncoder($user);
 
         return $encoder->isPasswordValid($user->getPassword(), $raw, $user->getSalt());
@@ -52,6 +56,10 @@ public function isPasswordValid(UserInterface $user, string $raw)
      */
     public function needsRehash(UserInterface $user): bool
     {
+        if (null === $user->getPassword()) {
+            return false;
+        }
+
         $encoder = $this->encoderFactory->getEncoder($user);
 
         return $encoder->needsRehash($user->getPassword());

Tests/Authentication/Provider/DaoAuthenticationProviderTest.php

@@ -147,7 +147,11 @@ public function testCheckAuthenticationWhenCredentialsAre0()
             ->willReturn('0')
         ;
 
-        $method->invoke($provider, new TestUser(), $token);
+        $method->invoke(
+            $provider,
+            new User('username', 'password'),
+            $token
+        );
     }
 
     public function testCheckAuthenticationWhenCredentialsAreNotValid()
@@ -169,7 +173,7 @@ public function testCheckAuthenticationWhenCredentialsAreNotValid()
               ->willReturn('foo')
         ;
 
-        $method->invoke($provider, new TestUser(), $token);
+        $method->invoke($provider, new User('username', 'password'), $token);
     }
 
     public function testCheckAuthenticationDoesNotReauthenticateWhenPasswordHasChanged()
@@ -241,7 +245,7 @@ public function testCheckAuthentication()
               ->willReturn('foo')
         ;
 
-        $method->invoke($provider, new TestUser(), $token);
+        $method->invoke($provider, new User('username', 'password'), $token);
     }
 
     public function testPasswordUpgrades()

Validator/Constraints/UserPasswordValidator.php

@@ -53,7 +53,7 @@ public function validate($password, Constraint $constraint)
 
         $encoder = $this->encoderFactory->getEncoder($user);
 
-        if (!$encoder->isPasswordValid($user->getPassword(), $password, $user->getSalt())) {
+        if (null === $user->getPassword() || !$encoder->isPasswordValid($user->getPassword(), $password, $user->getSalt())) {
             $this->context->addViolation($constraint->message);
         }
     }