admin/alist
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: prevent guest user from updating profile (#8447)

Browse Source
This commit is contained in:
yoclo 2025-04-29 23:14:16 +08:00 committed by GitHub
parent b2b91a9281
commit 11e7284824
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
server/handles/auth.go
View File

@ -113,6 +113,10 @@ func UpdateCurrent(c *gin.Context) {
return return
} }
user := c.MustGet("user").(*model.User) user := c.MustGet("user").(*model.User)
if user.IsGuest() {
common.ErrorStrResp(c, "Guest user can not update profile", 403)
return
}
user.Username = req.Username user.Username = req.Username
if req.Password != "" { if req.Password != "" {
user.SetPassword(req.Password) user.SetPassword(req.Password)