Merge branch 'master' into v3

server/auth/LocalAuthStrategy.js

@@ -49,6 +49,12 @@ class LocalAuthStrategy {
    * @param {Function} done - Passport callback
    */
   async verifyCredentials(req, username, password, done) {
+    if (typeof username !== 'string' || typeof password !== 'string') {
+      this.logFailedLoginAttempt(req, typeof username === 'string' ? username : '[non-string]', 'Invalid username or password')
+      done(null, null)
+      return
+    }
+
     // Load the user given it's username
     const user = await Database.userModel.getUserByUsername(username.toLowerCase())
 

server/auth/OidcAuthStrategy.js

@@ -393,7 +393,15 @@ class OidcAuthStrategy {
    * @returns {string|null}
    */
   getEndSessionUrl(req, idToken, authMethod) {
-    const client = this.getClient()
+    // Logout trusts the auth_method cookie. getClient() throws when OpenID is not
+    // configured, and that throw is outside the request promise, so it exits the process.
+    let client
+    try {
+      client = this.getClient()
+    } catch (error) {
+      Logger.error(`[OidcAuth] Cannot build end session URL - ${error.message}`)
+      return null
+    }
 
     if (client.issuer.end_session_endpoint && client.issuer.end_session_endpoint.length > 0) {
       let postLogoutRedirectUri = null