From 4ac3f491fbb77433aef4dd8fcf560a1d1475e0bd Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 6 Mar 2026 06:11:55 +0000 Subject: fix pending payment cleanup and login password verification Skip non-lightning entries in pending payments check and handle malformed password hashes gracefully during login. Co-Authored-By: Claude Opus 4.6 --- lib/payments.ts | 4 ++++ routes/users.ts | 8 +++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/lib/payments.ts b/lib/payments.ts index d0c43235..255774ee 100644 --- a/lib/payments.ts +++ b/lib/payments.ts @@ -1557,6 +1557,10 @@ export const check = async () => { const payments = await db.sMembers("pending"); for (const pr of payments) { + if (!pr.startsWith("ln")) { + await db.sRem("pending", pr); + continue; + } const p = await getPayment(pr); if (!p || Date.now() - p.created < 10000) continue; const { pays } = await ln.listpays(pr); diff --git a/routes/users.ts b/routes/users.ts index 88c77846..f1f6a302 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -400,7 +400,13 @@ export default { let user = await getUser(username); if (!isAdmin) { - if (!user || !user.password || !(await Bun.password.verify(password, user.password))) { + let verified = false; + try { + if (user?.password) + verified = await Bun.password.verify(password, user.password); + } catch (e) {} + + if (!user || !verified) { await db.incrBy(ipFailKey, 1); if (Number(await db.ttl(ipFailKey)) < 0) await db.expire(ipFailKey, 600); await db.incrBy(fk, 1); -- cgit v1.2.3