never skip password verification

2019-11-07 13:06:31 -08:00
parent ab650c7a95
commit 5c920fd200
4 changed files with 11 additions and 14 deletions
--- a/src/routes/users.js
+++ b/src/routes/users.js
@@ -120,8 +120,6 @@ function remove(req, res, next) {
 function verifyPassword(req, res, next) {
    assert.strictEqual(typeof req.body, 'object');

-    if (req.authInfo.skipPasswordVerification) return next(); // using an 'sdk' token we skip password checks
-
    if (typeof req.body.password !== 'string') return next(new HttpError(400, 'API call requires user password'));

    users.verifyWithUsername(req.user.username, req.body.password, function (error) {