Mizah/Sharkey
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

prevent login and password reset for system accounts

Browse source
This commit is contained in:
Hazel K 2024-10-07 14:58:39 -04:00
parent 126a2fcf15
commit cd9bce3072
8 changed files with 45 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
packages/backend/src/server/api/endpoints/admin/reset-password.ts
View file

@ -11,6 +11,7 @@ import type { UsersRepository, UserProfilesRepository } from '@/models/_.js';
import { DI } from '@/di-symbols.js';
import { secureRndstr } from '@/misc/secure-rndstr.js';
import { ModerationLogService } from '@/core/ModerationLogService.js';
import { isSystemAccount } from '@/misc/is-system-account.js';
export const meta = {
tags: ['admin'],
@ -63,6 +64,10 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
throw new Error('cannot reset password of root');
}
if (isSystemAccount(user)) {
throw new Error('cannot reset password of system account');
}
const passwd = secureRndstr(8);
// Generate hash of password