diff --git a/src/ldap.js b/src/ldap.js index efd8d3562..38c57c211 100644 --- a/src/ldap.js +++ b/src/ldap.js @@ -486,11 +486,11 @@ function authorizeUserForApp(req, res, next) { assert.strictEqual(typeof req.user, 'object'); assert.strictEqual(typeof req.app, 'object'); - apps.hasAccessTo(req.app, req.user, function (error, result) { + apps.hasAccessTo(req.app, req.user, function (error, hasAccess) { if (error) return next(new ldap.OperationsError(error.toString())); // we return no such object, to avoid leakage of a users existence - if (!result) return next(new ldap.NoSuchObjectError(req.dn.toString())); + if (!hasAccess) return next(new ldap.NoSuchObjectError(req.dn.toString())); eventlog.add(eventlog.ACTION_USER_LOGIN, { authType: 'ldap', appId: req.app.id }, { userId: req.user.id, user: users.removePrivateFields(req.user) });