From 94f53842b1b59adc0048a71175b409c5b44b8e3c Mon Sep 17 00:00:00 2001
From: Patrick Pfeiffer <patrick@bitfly.at>
Date: Mon, 11 Mar 2024 14:31:26 +0100
Subject: [PATCH] (NOBIDS) prevent pw reset if not allowed

---
 handlers/auth.go |  9 +++++++++
 handlers/user.go | 18 +++++++++++++-----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/handlers/auth.go b/handlers/auth.go
index 69350fa8cf..c6839a0cf5 100644
--- a/handlers/auth.go
+++ b/handlers/auth.go
@@ -736,6 +736,15 @@ func sendPasswordResetEmail(email string) error {
 	}
 	defer tx.Rollback()
 
+	var passwordResetNotAllowed bool
+	err = tx.Get(&passwordResetNotAllowed, "SELECT password_reset_not_allowed FROM users WHERE email = $1", email)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return fmt.Errorf("error getting password_reset_not_allowed: %w", err)
+	}
+	if passwordResetNotAllowed {
+		return fmt.Errorf("password-reset not allowed for user: %v", email)
+	}
+
 	var lastTs *time.Time
 	err = tx.Get(&lastTs, "SELECT password_reset_ts FROM users WHERE email = $1", email)
 	if err != nil && !errors.Is(err, sql.ErrNoRows) {
diff --git a/handlers/user.go b/handlers/user.go
index d0363dcc1b..bb6ca2010f 100644
--- a/handlers/user.go
+++ b/handlers/user.go
@@ -1046,13 +1046,14 @@ func UserUpdatePasswordPost(w http.ResponseWriter, r *http.Request) {
 	pwdOld := r.FormValue("old-password")
 
 	currentUser := struct {
-		ID        int64  `db:"id"`
-		Email     string `db:"email"`
-		Password  string `db:"password"`
-		Confirmed bool   `db:"email_confirmed"`
+		ID                      int64  `db:"id"`
+		Email                   string `db:"email"`
+		Password                string `db:"password"`
+		Confirmed               bool   `db:"email_confirmed"`
+		PasswordResetNotAllowed bool   `db:"password_reset_not_allowed"`
 	}{}
 
-	err = db.FrontendWriterDB.Get(&currentUser, "SELECT id, email, password, email_confirmed FROM users WHERE id = $1", user.UserID)
+	err = db.FrontendWriterDB.Get(&currentUser, "SELECT id, email, password, email_confirmed, password_reset_not_allowed FROM users WHERE id = $1", user.UserID)
 	if err != nil {
 		if err != sql.ErrNoRows {
 			logger.Errorf("error retrieving password for user %v: %v", user.UserID, err)
@@ -1063,6 +1064,13 @@ func UserUpdatePasswordPost(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if currentUser.PasswordResetNotAllowed {
+		session.AddFlash("Error: Password reset is not allowed for this account!")
+		session.Save(r, w)
+		http.Redirect(w, r, "/user/settings", http.StatusSeeOther)
+		return
+	}
+
 	if !currentUser.Confirmed {
 		session.AddFlash("Error: Email has not been confirmed, please click the link in the email we sent you or <a href='/resend'>resend link</a>!")
 		session.Save(r, w)