fix force password resets with allowaccountreset: false #7527 #6261
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
Jan 5, 2026 at 23:34 UTC
adc8623c5715f7560af97f7ab4843d51feabff0c
1 file changed
+2
-1
webserver.js
+2
-1
@@ -1428,6 +1428,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
1428
const sec = parent.decryptSessionData(req.session.e);
1429
sec.rtuser = xusername;
1430
sec.rtpass = xpassword;
1431
+ sec.rtreset = true;
1432
req.session.e = parent.encryptSessionData(sec);
1433
1434
if (direct === true) { handleRootRequestEx(req, res, domain); } else { res.redirect(domain.url + getQueryPortion(req)); }
@@ -1685,7 +1686,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
1686
const sec = parent.decryptSessionData(req.session.e);
1687
1688
// Check everything is ok
1688
- const allowAccountReset = ((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.allowaccountreset !== false));
1689
+ const allowAccountReset = ((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.allowaccountreset !== false) || (sec.rtreset === true));
1690
if ((allowAccountReset === false) || (domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap') || (typeof req.body.rpassword1 != 'string') || (typeof req.body.rpassword2 != 'string') || (req.body.rpassword1 != req.body.rpassword2) || (typeof req.body.rpasswordhint != 'string') || (req.session == null) || (typeof sec.rtuser != 'string') || (typeof sec.rtpass != 'string')) {
1691
parent.debug('web', 'handleResetPasswordRequest: checks failed');
1692
delete req.session.e;