From 4d6a799c5d56d42266ffa9b2166cd37beb9a9476 Mon Sep 17 00:00:00 2001 From: Florian Sylvain Date: Tue, 14 May 2024 20:41:33 +0200 Subject: [PATCH] fix: comparing verificationCode hashes --- api/pageRegisterValidate.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/api/pageRegisterValidate.go b/api/pageRegisterValidate.go index 5cff532..7e06242 100644 --- a/api/pageRegisterValidate.go +++ b/api/pageRegisterValidate.go @@ -2,6 +2,7 @@ package api import ( "github.com/go-chi/jwtauth/v5" + "golang.org/x/crypto/bcrypt" "net/http" "time" ) @@ -19,7 +20,8 @@ func GetRegisterValidatePage(w http.ResponseWriter, r *http.Request) { user, _ := Container.GetUserUseCase.GetUser(userId) errorMessage := "" - if user.VerificationCode != queryVerificationCode || user.VerificationExpiration.Before(time.Now()) { + err := bcrypt.CompareHashAndPassword([]byte(user.VerificationCode), []byte(queryVerificationCode)) + if err != nil || user.VerificationExpiration.Before(time.Now()) { errorMessage = "Verification link is incorrect or has expired." } else { // TODO New usecase "UpdateUserUseCase" to update its verification status