fix: prevent password reset on disabled account

requarks · Aug 29, 2024 · b9fb17d · b9fb17d
1 parent d1b4c8c
commit b9fb17d
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/server/models/users.js b/server/models/users.js
@@ -499,6 +499,10 @@ module.exports = class User extends Model {
     })
 
     if (usr) {
+      if (!usr.isActive) {
+        throw new WIKI.Error.AuthAccountBanned()
+      }
+
       await WIKI.models.users.query().patch({
         password: newPassword,
         mustChangePwd: false
@@ -527,6 +531,9 @@ module.exports = class User extends Model {
     if (!usr) {
       WIKI.logger.debug(`Password reset attempt on nonexistant local account ${email}: [DISCARDED]`)
       return
+    } else if (!usr.isActive) {
+      WIKI.logger.debug(`Password reset attempt on disabled local account ${email}: [DISCARDED]`)
+      return
     }
     const resetToken = await WIKI.models.userKeys.generateToken({
       userId: usr.id,