verdnatura-mirror
/
loopback
mirror of https://github.com/strongloop/loopback.git
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Require valid login credentials before verified email check. 

- strongloop/loopback#931.
This commit is contained in:
Ron Edgecomb 2014-12-18 13:07:31 -05:00
parent 2368eb569a
commit dc055e5559
1 changed files with 21 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
common/models/user.js
View File

@ -183,33 +183,32 @@ module.exports = function(User) {
debug('An error is reported from User.findOne: %j', err); debug('An error is reported from User.findOne: %j', err);
fn(defaultError); fn(defaultError);
} else if (user) { } else if (user) {
if (self.settings.emailVerificationRequired) {
if (!user.emailVerified) {
// Fail to log in if email verification is not done yet
debug('User email has not been verified');
err = new Error('login failed as the email has not been verified');
err.statusCode = 401;
return fn(err);
}
}
user.hasPassword(credentials.password, function(err, isMatch) { user.hasPassword(credentials.password, function(err, isMatch) {
if (err) { if (err) {
debug('An error is reported from User.hasPassword: %j', err); debug('An error is reported from User.hasPassword: %j', err);
fn(defaultError); fn(defaultError);
} else if (isMatch) { } else if (isMatch) {
user.createAccessToken(credentials.ttl, function(err, token) { if (self.settings.emailVerificationRequired && !user.emailVerified) {
if (err) return fn(err); // Fail to log in if email verification is not done yet
if (Array.isArray(include) ? include.indexOf('user') !== -1 : include === 'user') { debug('User email has not been verified');
// NOTE(bajtos) We can't set token.user here: err = new Error('login failed as the email has not been verified');
// 1. token.user already exists, it's a function injected by err.statusCode = 401;
// "AccessToken belongsTo User" relation return fn(err);
// 2. ModelBaseClass.toJSON() ignores own properties, thus } else {
// the value won't be included in the HTTP response user.createAccessToken(credentials.ttl, function(err, token) {
// See also loopback#161 and loopback#162 if (err) return fn(err);
token.__data.user = user; if (Array.isArray(include) ? include.indexOf('user') !== -1 : include === 'user') {
} // NOTE(bajtos) We can't set token.user here:
fn(err, token); // 1. token.user already exists, it's a function injected by
}); // "AccessToken belongsTo User" relation
// 2. ModelBaseClass.toJSON() ignores own properties, thus
// the value won't be included in the HTTP response
// See also loopback#161 and loopback#162
token.__data.user = user;
}
fn(err, token);
});
}
} else { } else {
debug('The password is invalid for user %s', query.email || query.username); debug('The password is invalid for user %s', query.email || query.username);
fn(defaultError); fn(defaultError);