vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

Merge pull request #37668 from UmakanthKaspa/fix-oauth-disabled-user

Browse source 
fix: reject OAuth tokens for disabled users
This commit is contained in:
Akhil Narang 2026-03-02 10:52:20 +05:30 • committed by GitHub
commit 34db776bc5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
frappe/auth.py
View file

@ -683,7 +683,10 @@ def validate_oauth(authorization_header):
uri, http_method, body, headers, required_scopes
)
if valid:
frappe.set_user(frappe.db.get_value("OAuth Bearer Token", token, "user"))
user = frappe.db.get_value("OAuth Bearer Token", token, "user")
if not frappe.db.get_value("User", user, "enabled"):
frappe.throw(_("User {0} is disabled").format(user), frappe.AuthenticationError)
frappe.set_user(user)
frappe.local.form_dict = form_dict
except AttributeError:
pass