deny sspi and ldap password change

2023-09-20 19:24:30 +01:00 · 2023-09-20 19:24:30 +01:00 · 545c029752
parent 04a71800fa
commit 545c029752
1 changed files with 4 additions and 1 deletions
--- a/meshuser.js
+++ b/meshuser.js
@ -1821,6 +1821,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
                    // If this account is settings locked, return here.
                    if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return;
                    
+                    // Do not allow change password if sspi or ldap
+                    if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) return;
+                    
                    // Change our own password
                    if (common.validateString(command.oldpass, 1, 256) == false) break;
                    if (common.validateString(command.newpass, 1, 256) == false) break;