{"record":{"id":"e54b7b3f33316c6f","repo":"louislam/dockge","slug":"invalid-new-password","errorCode":null,"errorMessage":"Invalid new password","messagePattern":"Invalid new password","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"backend/socket-handlers/main-socket-handler.ts","lineNumber":215,"sourceCode":"\n                log.warn(\"auth\", `Incorrect username or password for user ${data.username}. IP=${clientIP}`);\n\n                callback({\n                    ok: false,\n                    msg: \"authIncorrectCreds\",\n                    msgi18n: true,\n                });\n            }\n\n        });\n\n        // Change Password\n        socket.on(\"changePassword\", async (password, callback) => {\n            try {\n                checkLogin(socket);\n\n                if (! password.newPassword) {\n                    throw new Error(\"Invalid new password\");\n                }\n\n                if (passwordStrength(password.newPassword).value === \"Too weak\") {\n                    throw new Error(\"Password is too weak. It should contain alphabetic and numeric characters. It must be at least 6 characters in length.\");\n                }\n\n                let user = await doubleCheckPassword(socket, password.currentPassword);\n                await user.resetPassword(password.newPassword);\n\n                server.disconnectAllSocketClients(user.id, socket.id);\n\n                callback({\n                    ok: true,\n                    msg: \"Password has been updated successfully.\",\n                });\n\n            } catch (e) {\n                if (e instanceof Error) {","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/louislam/dockge/blob/f809ae192b571944ad773e9866d3e67064ae8043/backend/socket-handlers/main-socket-handler.ts#L197-L233","documentation":"In the 'changePassword' socket handler, before any strength check, the payload's newPassword field is verified to be present and truthy. An empty, null, or undefined newPassword means nothing to change, so 'Invalid new password' is thrown and returned via the callback.","triggerScenarios":"Emitting 'changePassword' with an object lacking newPassword, e.g. { currentPassword: 'old1' } or { currentPassword: 'old1', newPassword: '' }.","commonSituations":"Frontend form submitted with blank new-password field; API scripts sending only the current password; field-name mismatches (e.g. sending new_password) so newPassword is undefined.","solutions":["Include a non-empty newPassword string in the changePassword payload.","Validate the form field is filled before emitting the event.","Ensure the payload property is named exactly newPassword."],"exampleFix":"// before\nsocket.emit('changePassword', { currentPassword: 'old1' }, cb);\n// after\nsocket.emit('changePassword', { currentPassword: 'old1', newPassword: 'newpass1' }, cb);","handlingStrategy":"validation","validationCode":"function canSubmitPasswordChange(p) {\n    return !!p && typeof p.currentPassword === 'string' && typeof p.newPassword === 'string' && p.newPassword.length > 0;\n}","typeGuard":"function hasNewPassword(p) { return typeof p?.newPassword === 'string' && p.newPassword.length > 0; }","tryCatchPattern":"socket.emit('changePassword', payload, (res) => {\n    if (!res.ok && /Invalid new password/.test(res.msg || '')) {\n        highlightNewPasswordField();\n    }\n});","preventionTips":["Require the new-password field in the form before submission","Use the exact property name newPassword in payloads","Trim input but reject empty strings before emitting"],"tags":["validation","password","authentication"],"backgroundTag":"missing-required-field","analyzedSha":"f809ae192b571944ad773e9866d3e67064ae8043","analyzedAt":"2026-08-31T19:13:50.919Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}