Fix blocked users being able to sign in using forgot password

Signed-off-by: Derrick Mehaffy <derrickmehaffy@gmail.com>
strapi · Aug 23, 2021 · c1329f2 · c1329f2
1 parent 5202c4e
commit c1329f2
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/packages/strapi-plugin-users-permissions/controllers/Auth.js b/packages/strapi-plugin-users-permissions/controllers/Auth.js
@@ -310,6 +310,11 @@ module.exports = {
       );
     }
 
+    // User blocked
+    if (user.blocked) {
+      return ctx.badRequest('blocked.user');
+    }
+
     // Generate random token.
     const resetPasswordToken = crypto.randomBytes(64).toString('hex');