Simplify customer authentication by removing default password logic and enforcing stricter checks for missing passwords.

2026-02-24 12:36:22 +01:00
parent 9920f1dd27
commit 84020bd051
1 changed files with 2 additions and 8 deletions
@@ -26,14 +26,8 @@ class authentication implements authentication_i
        }
        // Check if the customer has a password
        if (!$customer->hasPassword()) {
-            // Make sure the customer group is 0, to prevent higher privilege users from accessing the system through the default password.
-            if ((int)$customer->group_id->value() !== 0) {
-                return false;
-            }
-            // Does have a customer number, set the password to the last 4 digits of the customer number
-            if (!empty($customer->customer_number->value()) && strlen($customer->customer_number->value()) > 4) {
-                $customer->setPassword(substr($customer->customer_number->value(), -4));
-            }
+            // If the customer doesn't have a password, we can't authenticate them, so we return false
+            return false;
        }
        // Check if the password is correct
        if (!$this->match_passwords($password, $customer->getPassword())) {