Only update bcrypt password rounds if the password actually matches

thelounge · Jun 2, 2017 · b46f92c · b46f92c · xPaw · Jun 2, 2017
1 parent 1f1b025
commit b46f92c
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/server.js b/src/server.js
@@ -287,7 +287,7 @@ function localAuth(client, user, password, callback) {
 	Helper.password
 		.compare(password, client.config.password)
 		.then(matching => {
-			if (Helper.password.requiresUpdate(client.config.password)) {
+			if (matching && Helper.password.requiresUpdate(client.config.password)) {
 				const hash = Helper.password.hash(password);
 
 				client.setPassword(hash, success => {