From cf6334e37d365e2427151ff04742572146fa4023 Mon Sep 17 00:00:00 2001 From: Kyle Spearrin Date: Tue, 31 Jul 2018 08:19:49 -0400 Subject: [PATCH] check to make sure user actually needs key update --- src/Core/Services/Implementations/UserService.cs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/Core/Services/Implementations/UserService.cs b/src/Core/Services/Implementations/UserService.cs index f08f4a4841..c137cb97bf 100644 --- a/src/Core/Services/Implementations/UserService.cs +++ b/src/Core/Services/Implementations/UserService.cs @@ -215,7 +215,7 @@ namespace Bit.Core.Services var tokenValid = false; if(_globalSettings.DisableUserRegistration && !string.IsNullOrWhiteSpace(token) && orgUserId.HasValue) { - tokenValid = CoreHelpers.UserInviteTokenIsValid(_organizationServiceDataProtector, token, + tokenValid = CoreHelpers.UserInviteTokenIsValid(_organizationServiceDataProtector, token, user.Email, orgUserId.Value); } @@ -456,6 +456,11 @@ namespace Bit.Core.Services if(await CheckPasswordAsync(user, masterPassword)) { + if(user.Key != null) + { + throw new BadRequestException("User already has an updated encryption key."); + } + user.RevisionDate = user.AccountRevisionDate = DateTime.UtcNow; user.SecurityStamp = Guid.NewGuid().ToString(); user.Key = key;