deny sspi and ldap password change
Simon Smith committed
Sep 20, 2023 at 19:24 UTC
545c02975238b9cf1a05483b48ede88eb29bf3b0
1 file changed
+4
-1
meshuser.js
+4
-1
@@ -1820,7 +1820,10 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1820
1821
// If this account is settings locked, return here.
1822
if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return;
1823
-
1823
+
1824
+ // Do not allow change password if sspi or ldap
1825
+ if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) return;
1826
+
1827
// Change our own password
1828
if (common.validateString(command.oldpass, 1, 256) == false) break;
1829
if (common.validateString(command.newpass, 1, 256) == false) break;