mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-03-08 00:17:15 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix for disabled logged-in users (#6612)

Browse Source 
fix https://github.com/FreshRSS/FreshRSS/issues/6611
Logged-in users were still able to use their account for some time despite having being disabled by admin
This commit is contained in:
Alexandre Alapetite
2024-07-08 11:05:58 +02:00
committed by GitHub
parent 8ae95055dc
commit 4738ca8512
2 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
app/Models/Auth.php
View File

@@ -31,15 +31,16 @@ class FreshRSS_Auth {
]);
}
if (self::$login_ok) {
self::giveAccess();
} elseif (self::accessControl() && self::giveAccess()) {
FreshRSS_UserDAO::touch();
} else {
// Be sure all accesses are removed!
self::removeAccess();
if (self::$login_ok && self::giveAccess()) {
return self::$login_ok;
}
return self::$login_ok;
if (self::accessControl() && self::giveAccess()) {
FreshRSS_UserDAO::touch();
return self::$login_ok;
}
// Be sure all accesses are removed!
self::removeAccess();
return false;
}
/**
@@ -103,7 +104,7 @@ class FreshRSS_Auth {
*/
public static function giveAccess(): bool {
FreshRSS_Context::initUser();
if (!FreshRSS_Context::hasUserConf()) {
if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::userConf()->enabled) {
self::$login_ok = false;
return false;
}

2
p/api/query.php
View File

@@ -36,7 +36,7 @@ if (!FreshRSS_Context::hasSystemConf() || !FreshRSS_Context::systemConf()->api_e
}
FreshRSS_Context::initUser($user);
if (!FreshRSS_Context::hasUserConf()) {
if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::userConf()->enabled) {
usleep(rand(100, 10000)); //Primitive mitigation of scanning for users
header('HTTP/1.1 404 Not Found');
header('Content-Type: text/plain; charset=UTF-8');