Browse Source
fix: prevent password reset on disabled account
pull/7350/head
Nicolas Giard
10 months ago
committed by
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with
7 additions and
0 deletions
-
server/models/users.js
|
|
|
@ -499,6 +499,10 @@ module.exports = class User extends Model { |
|
|
|
}) |
|
|
|
|
|
|
|
if (usr) { |
|
|
|
if (!usr.isActive) { |
|
|
|
throw new WIKI.Error.AuthAccountBanned() |
|
|
|
} |
|
|
|
|
|
|
|
await WIKI.models.users.query().patch({ |
|
|
|
password: newPassword, |
|
|
|
mustChangePwd: false |
|
|
|
@ -527,6 +531,9 @@ module.exports = class User extends Model { |
|
|
|
if (!usr) { |
|
|
|
WIKI.logger.debug(`Password reset attempt on nonexistant local account ${email}: [DISCARDED]`) |
|
|
|
return |
|
|
|
} else if (!usr.isActive) { |
|
|
|
WIKI.logger.debug(`Password reset attempt on disabled local account ${email}: [DISCARDED]`) |
|
|
|
return |
|
|
|
} |
|
|
|
const resetToken = await WIKI.models.userKeys.generateToken({ |
|
|
|
userId: usr.id, |
|
|
|
|
