Fix blocked users being able to sign in using forgot password #10787
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Derrick Mehaffy <derrickmehaffy@gmail.com>
Codecov Report
@@ Coverage Diff @@
## master #10787 +/- ##
=======================================
Coverage 58.12% 58.12%
=======================================
Files 185 185
Lines 6429 6429
Branches 1395 1395
=======================================
Hits 3737 3737
Misses 2230 2230
Partials 462 462
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report at Codecov.
|
petersg83
suggested changes
Aug 24, 2021
| @@ -310,6 +310,11 @@ module.exports = { | |||
| ); | |||
| } | |||
|
|
|||
| // User blocked | |||
| if (user.blocked) { | |||
| return ctx.badRequest('blocked.user'); | |||
There was a problem hiding this comment.
Can you use the same format as line 304? Thus the message can be directly displayed in the front!
(and if you can fix the missing "a" line 286 too :p)
petersg83
added
source: plugin:users-permissions
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Signed-off-by: Derrick Mehaffy derrickmehaffy@gmail.com
What does it do?
Adds a check in the forgot password controller to see if a user is blocked and return the valid error message if they are
Why is it needed?
Blocked users should not be able to perform any request at all
How to test it?
Create a user, set them as blocked, and attempt to send a password reset request
Related issue(s)/PR(s)
fixes #10776