From 2be369394f78bd2facb1dd52de25aafc1c97f717 Mon Sep 17 00:00:00 2001 From: Luca Versari Date: Tue, 15 Sep 2026 21:16:59 +0200 Subject: [PATCH] Do not allow disabled logged-in administrators to use AWS. --- cms/server/admin/rpc_authorization.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/cms/server/admin/rpc_authorization.py b/cms/server/admin/rpc_authorization.py index 9d47e61ac1..21d67b4220 100644 --- a/cms/server/admin/rpc_authorization.py +++ b/cms/server/admin/rpc_authorization.py @@ -64,7 +64,12 @@ def rpc_authorization_checker( with SessionGen() as session: # Load admin. - admin: Admin = session.query(Admin).filter(Admin.id == admin_id).first() + admin: Admin | None = ( + session.query(Admin) + .filter(Admin.id == admin_id) + .filter(Admin.enabled.is_(True)) + .first() + ) if admin is None: return False