From 9a7fd9600bf513adffbf2127be7c3a8b4d31073f Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Wed, 20 May 2020 10:04:44 +0200 Subject: Fix external auth email/password update Also check if an actor does not already exist when creating the user --- server/middlewares/validators/users.ts | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'server/middlewares/validators/users.ts') diff --git a/server/middlewares/validators/users.ts b/server/middlewares/validators/users.ts index 840b9fc74..3bdbcdf6a 100644 --- a/server/middlewares/validators/users.ts +++ b/server/middlewares/validators/users.ts @@ -234,14 +234,19 @@ const usersUpdateMeValidator = [ async (req: express.Request, res: express.Response, next: express.NextFunction) => { logger.debug('Checking usersUpdateMe parameters', { parameters: omit(req.body, 'password') }) + const user = res.locals.oauth.token.User + if (req.body.password || req.body.email) { + if (user.pluginAuth !== null) { + return res.status(400) + .json({ error: 'You cannot update your email or password that is associated with an external auth system.' }) + } + if (!req.body.currentPassword) { return res.status(400) .json({ error: 'currentPassword parameter is missing.' }) - .end() } - const user = res.locals.oauth.token.User if (await user.isPasswordMatch(req.body.currentPassword) !== true) { return res.status(401) .json({ error: 'currentPassword is invalid.' }) -- cgit v1.2.3