From c0a0f5c1ac6bbcfddc5ce15800483f1e2d7226a5 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Wed, 4 Nov 2026 14:31:51 -0700 Subject: login: tell the client when an account's password was reset A rekeyed account holds the literal "reset" instead of a hash, so no password can match. Return "account reset" so the client can send the owner to support. The check runs after the captcha and the per-IP failure cap, and counts as a failure. Co-Authored-By: Claude Opus 5.5 --- routes/users.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'routes/users.ts') diff --git a/routes/users.ts b/routes/users.ts index 400b554b..77ddbdc6 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -559,6 +559,17 @@ export default { let user = await getUser(username); if (!isAdmin) { + // changeid leaves the literal "reset" in place of a hash, so no + // password can ever match. Say so, letting the client point the + // owner at support instead of a generic login failure. This runs + // after the captcha and the per-IP failure cap, and counts as a + // failure itself. + if (user?.password === "reset") { + await db.incrBy(ipFailKey, 1); + if ((await db.ttl(ipFailKey)) < 0) await db.expire(ipFailKey, 600); + return res.code(401).send("account reset"); + } + let verified = false; try { if (user?.password) -- cgit v1.2.3