Jakub Zych 15ff9793ba fix: login refuses a not-activated account while require_activation is on ...

The refusal is the same 401 invalid-login answer as a wrong password and is counted by the login throttle.
The activation is checked after the password and before the deactivation restore, so a refused account stays deactivated.
require_activation false keeps the previous behaviour.

2026-10-22 21:25:53 +02:00

67 KiB

Raw Blame History

View Raw