allow password resets when using allowaccountreset and reset together #6261
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
Sep 30, 2024 at 12:20 UTC
8e5aa35bf3ba169611a074b24a32cf944264f443
1 file changed
+1
-1
webserver.js
+1
-1
@@ -1635,7 +1635,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
1635
const sec = parent.decryptSessionData(req.session.e);
1636
1637
// Check everything is ok
1638
- const allowAccountReset = ((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.allowaccountreset !== false));
1638
+ const allowAccountReset = ((typeof domain.passwordrequirements != 'object') || (typeof domain.passwordrequirements.reset === 'number' && domain.passwordrequirements.allowaccountreset !== false));
1639
if ((allowAccountReset === false) || (domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap') || (typeof req.body.rpassword1 != 'string') || (typeof req.body.rpassword2 != 'string') || (req.body.rpassword1 != req.body.rpassword2) || (typeof req.body.rpasswordhint != 'string') || (req.session == null) || (typeof sec.rtuser != 'string') || (typeof sec.rtpass != 'string')) {
1640
parent.debug('web', 'handleResetPasswordRequest: checks failed');
1641
delete req.session.e;