From 69d17aea7e0cfdd6429fdbb07c2a1f5c7497e798 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 6 Mar 2026 06:11:55 +0000 Subject: fix pending payment cleanup and login password verification Skip non-lightning entries in pending payments check and handle malformed password hashes gracefully during login. Co-Authored-By: Claude Opus 4.6 --- lib/payments.ts | 4 ++++ routes/users.ts | 12 +++++++----- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/lib/payments.ts b/lib/payments.ts index eed9b4c5..53b8dec1 100644 --- a/lib/payments.ts +++ b/lib/payments.ts @@ -778,6 +778,10 @@ export const check = async () => { const payments = await db.sMembers("pending"); for (const pr of payments) { + if (!pr.startsWith("ln")) { + await db.sRem("pending", pr); + continue; + } const p = await getPayment(pr); if (!p || Date.now() - p.created < 10000) continue; const { pays } = await ln.listpays(pr); diff --git a/routes/users.ts b/routes/users.ts index ef2ee449..9820f504 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -405,11 +405,13 @@ export default { let user = await getUser(username); if (!isAdmin) { - if ( - !user || - !user.password || - !(await Bun.password.verify(password, user.password)) - ) { + let verified = false; + try { + if (user?.password) + verified = await Bun.password.verify(password, user.password); + } catch (e) {} + + if (!user || !verified) { await db.incrBy(ipFailKey, 1); if ((await db.ttl(ipFailKey)) < 0) await db.expire(ipFailKey, 600); await db.incrBy(fk, 1); -- cgit v1.2.3