mantisbt/mantisbt — comment on commit 5e9ead33df0bc08364d88040adde63bd8c6c889f
File:  line 0
By vboctor:

Good fix!

I wonder if we should only return false when the password is null, otherwise, we should allow validation of blank passwords. For example, when users are created by administrator and email notifications are off, they are created with empty passwords. In such case, they won't be able to login via a client that is dependent on SOAP API. Not a typical scenario, but it seems we are failing for a case that should be valid.