calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-19 18:52:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3598 from shleeable/patch-12

Browse Source 
Fix: ensuring only internal users can request password resets.
This commit is contained in:
Milo Schwartz
2026-08-19 10:35:52 -04:00
committed by GitHub
parent 18270381c1 4edd2e4d32
commit 21eb4d2876
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/auth/requestPasswordReset.ts
+7 -2
View File
@@ -6,7 +6,7 @@ import HttpCode from "@server/types/HttpCode";
import { response } from "@server/lib/response"; import { response } from "@server/lib/response";
import { db } from "@server/db"; import { db } from "@server/db";
import { passwordResetTokens, users } from "@server/db"; import { passwordResetTokens, users } from "@server/db";
import { eq } from "drizzle-orm"; import { eq, and } from "drizzle-orm";
import { alphabet, generateRandomString, sha256 } from "oslo/crypto"; import { alphabet, generateRandomString, sha256 } from "oslo/crypto";
import { createDate } from "oslo"; import { createDate } from "oslo";
import logger from "@server/logger"; import logger from "@server/logger";
@@ -49,7 +49,12 @@ export async function requestPasswordReset(
const existingUser = await db const existingUser = await db
.select() .select()
.from(users) .from(users)
.where(eq(users.email, email)); .where(
and(
eq(users.email, email),
eq(users.type, UserType.Internal)
)
);
if (!existingUser || !existingUser.length) { if (!existingUser || !existingUser.length) {
await randomDelay(2000); await randomDelay(2000);