hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'mongoose-secure' into 'develop'

Browse source 
mongoose auth endpoint worked for deactivated accounts

See merge request pleroma/pleroma!2432
This commit is contained in:
lain 2020-04-28 09:18:59 +00:00
commit 9994768312
2 changed files with 24 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/pleroma/web/mongooseim/mongoose_im_controller.ex
View file

@ -14,7 +14,7 @@ defmodule Pleroma.Web.MongooseIM.MongooseIMController do
plug(RateLimiter, [name: :authentication, params: ["user"]] when action == :check_password)
def user_exists(conn, %{"user" => username}) do
with %User{} <- Repo.get_by(User, nickname: username, local: true) do
with %User{} <- Repo.get_by(User, nickname: username, local: true, deactivated: false) do
conn
|> json(true)
else
@ -26,7 +26,7 @@ defmodule Pleroma.Web.MongooseIM.MongooseIMController do
end
def check_password(conn, %{"user" => username, "pass" => password}) do
with %User{password_hash: password_hash} <-
with %User{password_hash: password_hash, deactivated: false} <-
Repo.get_by(User, nickname: username, local: true),
true <- Pbkdf2.checkpw(password, password_hash) do
conn