Bugfix: accessing user before declaration
Noah Zalev committed
Jun 22, 2021 at 22:18 UTC
e4c08dedf810a5e8d92b51acdc917311257e46d6
1 file changed
+2
-1
webserver.js
+2
-1
@@ -6287,6 +6287,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
6287
// A user/pass is provided in URL arguments
6288
obj.authenticate(req.query.user, req.query.pass, domain, function (err, userid, passhint, loginOptions) {
6289
6290
+ var user = obj.users[userid];
6291
+
6292
// Check if user as the "notools" site right. If so, deny this connection as tools are not allowed to connect.
6293
if ((user != null) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & SITERIGHT_NOMESHCMD)) {
6294
// No tools allowed, close the websocket connection
@@ -6299,7 +6301,6 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
6301
var twoFactorCookieDays = 30;
6302
if (typeof domain.twofactorcookiedurationdays == 'number') { twoFactorCookieDays = domain.twofactorcookiedurationdays; }
6303
6302
- var user = obj.users[userid];
6304
if ((err == null) && (user)) {
6305
// Check if a 2nd factor is needed
6306
if (checkUserOneTimePasswordRequired(domain, user, req, loginOptions) == true) {