diff options
Diffstat (limited to 'routes')
| -rw-r--r-- | routes/lnurl.ts | 8 | ||||
| -rw-r--r-- | routes/users.ts | 5 |
2 files changed, 11 insertions, 2 deletions
diff --git a/routes/lnurl.ts b/routes/lnurl.ts index 0472d758..7f04db5d 100644 --- a/routes/lnurl.ts +++ b/routes/lnurl.ts @@ -138,7 +138,10 @@ export default { if (v3) return res.send(v3); const user = await getUser(name); - if (!user) fail(`User ${username} not found`); + // Evicted accounts can't receive either: stops a lightning address that + // a scam page points victims at from issuing new invoices. + if (!user || (await db.sIsMember("evicted", user.id))) + fail(`User ${username} not found`); const { id: uid } = user; const metadata = JSON.stringify([ @@ -179,7 +182,8 @@ export default { const uid = await g(`lnurl:${id}`); const user = await getUser(uid); - if (!user) fail("user not found"); + if (!user || (await db.sIsMember("evicted", user.id))) + fail("user not found"); let { username } = user; username = username.replace(/\s/g, "").toLowerCase(); diff --git a/routes/users.ts b/routes/users.ts index 431425b4..347b7dd4 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -482,6 +482,11 @@ export default { } } + // Evicted accounts can't use a token anyway (see lib/auth.ts), so don't + // mint one — checked after the password so it can't be used to probe. + if (!isAdmin && (await db.sIsMember("evicted", user.id))) + return res.code(403).send("account disabled"); + if (username !== "coinos") l("logged in", username, req.headers["cf-connecting-ip"]); |