fix: reject password reset token requests for disabled users

2026-03-20 10:08:08 +01:00 · 2026-03-20 10:08:08 +01:00 · 708ccab895
parent d8570c603d
commit 708ccab895
1 changed files with 4 additions and 0 deletions
--- a/pkg/user/user_password_reset.go
+++ b/pkg/user/user_password_reset.go
@ -116,6 +116,10 @@ func RequestUserPasswordResetTokenByEmail(s *xorm.Session, tr *PasswordTokenRequ
 		return
 	}

+	if user.Status == StatusDisabled {
+		return &ErrAccountDisabled{UserID: user.ID}
+	}
+
 	return RequestUserPasswordResetToken(s, user)
 }