From 52532cc2e6d060b97171c7e42ecce9be68957fb9 Mon Sep 17 00:00:00 2001 From: NGPixel Date: Sat, 10 Oct 2026 22:03:27 -0400 Subject: [PATCH] fix: prevent activation from link recently generated before a user ban --- backend/models/users.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/backend/models/users.ts b/backend/models/users.ts index fd6cf1fce..36f3a8b1b 100644 --- a/backend/models/users.ts +++ b/backend/models/users.ts @@ -2600,7 +2600,7 @@ class Users { * Nobody is signed in by it: the new password is what does that, on the login screen. * * @throws `ERR_INVALID_VALIDATION_TOKEN`, `ERR_EXPIRED_VALIDATION_TOKEN`, `ERR_INVALID_USER`, - * `ERR_INVALID_STRATEGY`, `ERR_PASSWORD_TOO_SHORT` + * `ERR_INACTIVE_USER`, `ERR_INVALID_STRATEGY`, `ERR_PASSWORD_TOO_SHORT` */ async resetPassword({ token, @@ -2618,6 +2618,10 @@ class Users { if (!user) { throw new Error('ERR_INVALID_USER') } + // -> A link sent before the account was deactivated must not still be able to change it + if (!user.isActive) { + throw new Error('ERR_INACTIVE_USER') + } const auth = (user.auth ?? {}) as Record // -> The strategy could have been deleted, or password login turned off, since the link was sent if (!auth[strategyId]?.password) {