Update:Guest user accounts cannot change the account password #537

server/controllers/MeController.js

@@ -133,6 +133,10 @@ class MeController {
 
   // PATCH: api/me/password
   updatePassword(req, res) {
+    if (req.user.isGuest) {
+      Logger.error(`[MeController] Guest user attempted to change password`, req.user.username)
+      return res.sendStatus(500)
+    }
     this.auth.userChangePassword(req, res)
   }
 

server/objects/user/User.js

@@ -33,6 +33,9 @@ class User {
   get isAdmin() {
     return this.type === 'admin'
   }
+  get isGuest() {
+    return this.type === 'guest'
+  }
   get isAdminOrUp() {
     return this.isAdmin || this.isRoot
   }