From dd11321fa362b357cdd12039ae11ec19c3d72fae Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Sat, 27 Apr 2019 08:46:50 -0400 Subject: git-auth: deny login if no password has been set After creating a new account, users need to verify their email address and set an initial password. Without setting a password, users cannot use their account on the web interface. However, when logging in via SSH, we did not check whether the account is verified. Fix this by only allowing SSH access once a password is set. Reported-by: Pat Hogan Signed-off-by: Lukas Fleischer --- aurweb/git/auth.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/aurweb/git/auth.py b/aurweb/git/auth.py index 828ed4e2..3b1e485f 100755 --- a/aurweb/git/auth.py +++ b/aurweb/git/auth.py @@ -39,7 +39,8 @@ def main(): cur = conn.execute("SELECT Users.Username, Users.AccountTypeID FROM Users " "INNER JOIN SSHPubKeys ON SSHPubKeys.UserID = Users.ID " - "WHERE SSHPubKeys.PubKey = ? AND Users.Suspended = 0", + "WHERE SSHPubKeys.PubKey = ? AND Users.Suspended = 0 " + "AND NOT Users.Passwd = ''", (keytype + " " + keytext,)) row = cur.fetchone() -- cgit v1.2.3-24-g4f1b