From 317beeac8d1d14c025f55c174a74cfbe8fcf31eb Mon Sep 17 00:00:00 2001
From: panda <panda_dtdyy@outlook.com>
Date: Sat, 20 Apr 2024 13:39:05 +0800
Subject: [PATCH] core: disable 2FA on reset password (#550)

---
 packages/hydrooj/src/handler/user.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/hydrooj/src/handler/user.ts b/packages/hydrooj/src/handler/user.ts
index 7b7dd8576..be5766cbb 100644
--- a/packages/hydrooj/src/handler/user.ts
+++ b/packages/hydrooj/src/handler/user.ts
@@ -384,6 +384,7 @@ class UserLostPassWithCodeHandler extends Handler {
         const tdoc = await token.get(code, token.TYPE_LOSTPASS);
         if (!tdoc) throw new InvalidTokenError(token.TYPE_TEXTS[token.TYPE_LOSTPASS], code);
         if (password !== verifyPassword) throw new VerifyPasswordError();
+        await user.setById(tdoc.uid, { authenticators: [], tfa: false });
         await user.setPassword(tdoc.uid, password);
         await token.del(code, token.TYPE_LOSTPASS);
         this.response.redirect = this.url('homepage');