From 051bceed8fc67cd1a8dad240ddaf7e13da12b77d Mon Sep 17 00:00:00 2001
From: Mawoka <git@mawoka.eu>
Date: Tue, 1 Aug 2023 21:32:04 +0200
Subject: [PATCH] :ambulance: Fixed login allowing unverified accounts

---
 classquiz/routers/login.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/classquiz/routers/login.py b/classquiz/routers/login.py
index d071ea6..a88d33e 100644
--- a/classquiz/routers/login.py
+++ b/classquiz/routers/login.py
@@ -110,7 +110,7 @@ async def start_login(data: StartLoginInput):
     step_2: set[StartLoginResponseTypes] = set()
     webauthn_data = None
     webauthn_challenge = None
-    if user is None:
+    if user is None or not user.verified:
         step_1.add(StartLoginResponseTypes.PASSWORD)
         return StartLoginResponse(step_1=step_1, step_2=step_2, session_id=os.urandom(16).hex(), webauthn_data=None)
     if user.password is not None: