external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: suspended users should not be able to login

Browse source 
Signed-off-by: Kevin Morris <kevr@0cost.org>
This commit is contained in:
Kevin Morris 2022-02-18 17:44:06 -08:00
parent e43e1c6d20
commit 7cc20cd9a4
No known key found for this signature in database
GPG key ID: F7E46DED420788F3
2 changed files with 25 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
aurweb/routers/auth.py
View file

@ -46,13 +46,19 @@ async def login_post(request: Request,
raise HTTPException(status_code=HTTPStatus.BAD_REQUEST,
detail=_("Bad Referer header."))
user = db.query(User).filter(
or_(User.Username == user, User.Email == user)
).first()
with db.begin():
user = db.query(User).filter(
or_(User.Username == user, User.Email == user)
).first()
if not user:
return await login_template(request, next,
errors=["Bad username or password."])
if user.Suspended:
return await login_template(request, next,
errors=["Account Suspended"])
cookie_timeout = cookies.timeout(remember_me)
sid = user.login(request, passwd, cookie_timeout)
if not sid: