event attemptingLogin preventable
Massimo Melina committed
Oct 25, 2024 at 14:52 UTC
4ec39ece706588ec90bf6663cca7d120206cfdad
4 files changed
+5
-4
src/api.auth.ts
+1
-1
@@ -19,7 +19,7 @@ export const loginSrp1: ApiHandler = async ({ username }, ctx) => {
19
const account = getAccount(username)
20
if (!ctx.session)
21
return new ApiError(HTTP_SERVER_ERROR)
22
- await events.emitAsync('attemptingLogin', { ctx, username })
22
+ if ((await events.emitAsync('attemptingLogin', { ctx, username }))?.isDefaultPrevented()) return
23
if (!account || !accountCanLogin(account)) { // TODO simulate fake account to prevent knowing valid usernames
24
ctx.logExtra({ u: username })
25
ctx.state.dontLog = false // log even if log_api is false
src/const.ts
+1
-1
@@ -7,7 +7,7 @@ import _ from 'lodash'
7
import { basename, dirname, join } from 'path'
8
export * from './cross-const'
9
10
-export const API_VERSION = 9.5
10
+export const API_VERSION = 9.6
11
export const COMPATIBLE_API_VERSION = 1 // while changes in the api are not breaking, this number stays the same, otherwise it is made equal to API_VERSION
12
export const HFS_REPO = 'rejetto/hfs'
13
src/middlewares.ts
+1
-1
@@ -132,7 +132,7 @@ export const prepareState: Koa.Middleware = async (ctx, next) => {
132
133
async function doLogin(u: string, p: string, via: string) {
134
if (!u || u === ctx.session?.username) return // providing credentials, but not needed
135
- await events.emitAsync('attemptingLogin', { ctx, username: u, via })
135
+ if ((await events.emitAsync('attemptingLogin', { ctx, username: u, via }))?.isDefaultPrevented()) return
136
const a = await srpCheck(u, p)
137
if (a) {
138
await setLoggedIn(ctx, a.username)
src/perm.ts
+2
-1
@@ -188,7 +188,8 @@ export function accountCanLogin(account: Account) {
188
function allDisabled(account: Account): boolean {
189
return Boolean(account.disabled
190
|| account.expire as any < Date.now()
191
- || account.belongs?.length && account.belongs.map(u => getAccount(u, false)).every(a => a && allDisabled(a))) // every() returns true on empty arrays
191
+ || account.belongs?.length // don't every() on empty array, as it returns true
192
+ && account.belongs.map(u => getAccount(u, false)).every(a => a && allDisabled(a)) )
193
}
194
195
export function accountCanLoginAdmin(account: Account) {