[bug] Fix basic auto-logins to disabled users

This commit is contained in:
Cohee 2024-10-09 02:12:20 +03:00
parent a1352d817a
commit fe8ffe5be8

View File

@ -674,11 +674,11 @@ async function basicUserLogin(request) {
if (login == userHandle) {
const user = await storage.getItem(toKey(userHandle));
// Verify pass again here just to be sure
if (user && user.password && user.password === getPasswordHash(password, user.salt)) {
if (user && user.enabled && user.password && user.password === getPasswordHash(password, user.salt)) {
request.session.handle = userHandle;
return true;
}
else if (user && !user.password && !password) {
else if (user && user.enabled && !user.password && !password) {
// Login to an account without password
request.session.handle = userHandle;
return true;