ember/continuwuity
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: Disallow issuing password reset tokens for deactivated users

Browse source
This commit is contained in:
Ginger 2026-03-03 13:43:01 -05:00
parent 5716c36b47
commit d13801e976
No known key found for this signature in database
1 changed files with 15 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
src/service/password_reset/mod.rs
View file

@ -49,25 +49,32 @@ impl Service {
/// Issue a password reset token for `user`, who must be a local user with /// Issue a password reset token for `user`, who must be a local user with
/// the `password` origin. /// the `password` origin.
pub async fn issue_token(&self, user: OwnedUserId) -> Result<ValidResetToken> { pub async fn issue_token(&self, user_id: OwnedUserId) -> Result<ValidResetToken> {
if !self.services.globals.user_is_local(&user) { if !self.services.globals.user_is_local(&user_id) {
return Err!("Cannot issue a password reset token for remote user {user}"); return Err!("Cannot issue a password reset token for remote user {user_id}");
} }
if user == self.services.globals.server_user { if user_id == self.services.globals.server_user {
return Err!("Cannot issue a password reset token for the server user"); return Err!("Cannot issue a password reset token for the server user");
} }
if self.services.users.origin(&user).await? != "password" { if self.services.users.origin(&user_id).await? != "password" {
return Err!("Cannot issue a password reset token for non-internal user {user}"); return Err!("Cannot issue a password reset token for non-internal user {user_id}");
} }
if let Some((existing_token, _)) = self.db.find_token_for_user(&user).await { if self.services.users.is_deactivated(&user_id).await? {
return Err!("Cannot issue a password reset token for deactivated user {user_id}");
}
if let Some((existing_token, _)) = self.db.find_token_for_user(&user_id).await {
self.db.remove_token(&existing_token); self.db.remove_token(&existing_token);
} }
let token = Self::generate_token_string(); let token = Self::generate_token_string();
let info = ResetTokenInfo { user, issued_at: SystemTime::now() }; let info = ResetTokenInfo {
user: user_id,
issued_at: SystemTime::now(),
};
self.db.save_token(&token, &info); self.db.save_token(&token, &info);