{"record":{"id":"769a6f84a0690c03","repo":"louislam/uptime-kuma","slug":"invalid-new-password","errorCode":null,"errorMessage":"Invalid new password","messagePattern":"Invalid new password","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"server/server.js","lineNumber":1451,"sourceCode":"\n                callback({\n                    ok: true,\n                    data: list,\n                });\n            } catch (e) {\n                callback({\n                    ok: false,\n                    msg: e.message,\n                });\n            }\n        });\n\n        socket.on(\"changePassword\", async (password, callback) => {\n            try {\n                checkLogin(socket);\n\n                if (!password.newPassword) {\n                    throw new Error(\"Invalid new password\");\n                }\n\n                if (passwordStrength(password.newPassword).value === \"Too weak\") {\n                    throw new TranslatableError(\"passwordTooWeak\");\n                }\n\n                let user = await doubleCheckPassword(socket, password.currentPassword);\n                await user.resetPassword(password.newPassword);\n\n                server.disconnectAllSocketClients(user.id, socket.id);\n\n                callback({\n                    ok: true,\n                    token: User.createJWT(user, server.jwtSecret),\n                    msg: \"successAuthChangePassword\",\n                    msgi18n: true,\n                });\n            } catch (e) {","sourceCodeStart":1433,"sourceCodeEnd":1469,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/server.js#L1433-L1469","documentation":"Thrown by the 'changePassword' socket handler when password.newPassword is falsy (missing, empty string, or null). This is the first guard, before the password-strength check and before doubleCheckPassword verifies the current password. The callback returns {ok:false, msg:'Invalid new password'}.","triggerScenarios":"A client emits 'changePassword' with an object whose newPassword field is empty/missing, or submits the form without entering a new password.","commonSituations":"Form submitted with the new-password field empty; the payload object built with the wrong key; refactor that renamed the field; client passing newPassword as undefined.","solutions":["Ensure the changePassword payload includes a non-empty newPassword string.","Disable the submit button until both current and new password fields are filled.","Validate newPassword is a non-empty string before emitting.","On {ok:false} with this message, focus the new-password input for the user."],"exampleFix":"// before\nsocket.emit('changePassword', { currentPassword, newPassword: '' }, cb);\n\n// after\nif (!newPassword) return toast.error('Enter a new password');\nsocket.emit('changePassword', { currentPassword, newPassword }, cb);","handlingStrategy":"validation","validationCode":"// Require a non-empty newPassword before emitting changePassword\nif (typeof password?.newPassword !== 'string' || password.newPassword.length === 0) {\n  return setError('Enter a new password.');\n}\nsocket.emit('changePassword', password, cb);","typeGuard":"function hasNewPassword(pw) {\n  return pw != null && typeof pw.newPassword === 'string' && pw.newPassword.length > 0;\n}","tryCatchPattern":null,"preventionTips":["Disable submit until the new-password field is non-empty.","Validate newPassword is a non-empty string before emitting.","Use the correct payload key (newPassword).","On {ok:false} with this message, focus the new-password input."],"tags":["auth","password","validation","socket","missing-argument"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}