verify code for add-username

cmu-sei · May 20, 2021 · 1e9fa65 · 1e9fa65
1 parent 10993cd
commit 1e9fa65
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/src/IdentityServer/Api/ProfileController.cs b/src/IdentityServer/Api/ProfileController.cs
@@ -265,12 +265,15 @@ await _mailer.Send(new MailMessage
         public async Task<IActionResult> AddUsername([FromBody] Credentials model)
         {
             string key = $"{User.GetSubjectId()}:{model.Username}:verifycode";
-            string code = await _cache.GetStringAsync(key);
 
-            if (string.IsNullOrEmpty(code) || model.Code != code)
+            bool verified = model.Code == await _cache.GetStringAsync(key) ||
+                await _svc.ValidateAccountCodeAsync(model.Username, model.Code);
+
+            if (!verified)
                 throw new AccountNotConfirmedException();
 
             await _svc.AddorUpdateAccountAsync(User.GetSubjectId(), model.Username);
+
             await _cache.RemoveAsync(key);
 
             Audit(AuditId.RegisteredCredential);