secure mongoose auth endpoint

This commit is contained in:
fence 2020-04-27 17:55:33 +02:00
parent dd4d10b275
commit a626cb682c

View file

@ -26,21 +26,36 @@ defmodule Pleroma.Web.MongooseIM.MongooseIMController do
end end
def check_password(conn, %{"user" => username, "pass" => password}) do def check_password(conn, %{"user" => username, "pass" => password}) do
with %User{password_hash: password_hash} <- user = Repo.get_by(User, nickname: username, local: true)
Repo.get_by(User, nickname: username, local: true),
true <- Pbkdf2.checkpw(password, password_hash) do
conn
|> json(true)
else
false ->
conn
|> put_status(:forbidden)
|> json(false)
_ -> case User.account_status(user) do
:deactivated ->
conn conn
|> put_status(:not_found) |> put_status(:not_found)
|> json(false) |> json(false)
:confirmation_pending ->
conn
|> put_status(:not_found)
|> json(false)
_ ->
with %User{password_hash: password_hash} <-
user,
true <- Pbkdf2.checkpw(password, password_hash) do
conn
|> json(true)
else
false ->
conn
|> put_status(:forbidden)
|> json(false)
_ ->
conn
|> put_status(:not_found)
|> json(false)
end
end end
end end
end end