Disallow password resets for deactivated accounts.
Ensure all responses to password reset events are identical.
This commit is contained in:
parent
d6e979aebe
commit
cbf7f0e029
4 changed files with 23 additions and 27 deletions
|
|
@ -72,7 +72,7 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do
|
|||
|
||||
def password_reset(nickname_or_email) do
|
||||
with true <- is_binary(nickname_or_email),
|
||||
%User{local: true, email: email} = user when is_binary(email) <-
|
||||
%User{local: true, email: email, deactivated: false} = user when is_binary(email) <-
|
||||
User.get_by_nickname_or_email(nickname_or_email),
|
||||
{:ok, token_record} <- Pleroma.PasswordResetToken.create_token(user) do
|
||||
user
|
||||
|
|
@ -81,17 +81,8 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do
|
|||
|
||||
{:ok, :enqueued}
|
||||
else
|
||||
false ->
|
||||
{:error, "bad user identifier"}
|
||||
|
||||
%User{local: true, email: nil} ->
|
||||
_ ->
|
||||
{:ok, :noop}
|
||||
|
||||
%User{local: false} ->
|
||||
{:error, "remote user"}
|
||||
|
||||
nil ->
|
||||
{:error, "unknown user"}
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue