VincentLambert 5cf95d2c0f Fix: admin password update crashes for SSO users (500 'NoneType' object has no attribute 'split') (#16914) ...

### What problem does this PR solve?

Setting a password from the admin panel for an SSO-provisioned account
(OIDC/OAuth/GitHub) returns a **500** with:

```
'NoneType' object has no attribute 'split'
```

**Root cause** — SSO-provisioned accounts have no local password, so
`usr.password` is `None` (the `User.password` column is `null=True`). In
`UserMgr.update_user_password` (`admin/server/services.py`), the "same
password" optimization calls:

```python
if check_password_hash(usr.password, psw):
```

`werkzeug.security.check_password_hash(None, psw)` internally does
`pwhash.split("$")`, which raises `AttributeError: 'NoneType' object has
no attribute 'split'` → surfaced as a 500.

**Repro**
1. Configure an SSO channel (OIDC/OAuth) under `oauth` in the service
config.
2. Log in once via SSO so the account is auto-provisioned (created
without a local password).
3. In the admin panel, set/change that user's password.
4. → 500 `'NoneType' object has no attribute 'split'`.

**Fix** — guard the equality check with `usr.password`. A passwordless
(SSO) user skips the comparison and goes straight to setting the new
password, which is the desired behavior (it gives them a password
fallback in addition to SSO).

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-14 23:30:35 +08:00

..

client

fix: remediate urllib3 CVEs (#16907)

2026-07-14 22:57:29 +08:00

server

Fix: admin password update crashes for SSO users (500 'NoneType' object has no attribute 'split') (#16914)

2026-07-14 23:30:35 +08:00

build_cli_release.sh

Use RAGFlow CLI to replace RAGFlow Admin CLI (#12653)

2026-01-17 17:52:38 +08:00