fix: add parens, add phone as sensitive field

supabase · Sep 11, 2024 · fb5b009 · fb5b009
1 parent 7e897c6
commit fb5b009
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/internal/api/user.go b/internal/api/user.go
@@ -101,7 +101,7 @@ func (a *API) UserUpdate(w http.ResponseWriter, r *http.Request) error {
 	}
 
 	if user.HasMFAEnabled() && !session.IsAAL2() {
-		if (params.Password != nil && *params.Password != "") || params.Email != "" && user.GetEmail() != params.Email {
+		if (params.Password != nil && *params.Password != "") || (params.Email != "" && user.GetEmail() != params.Email) || (params.Phone != "" && user.GetPhone() != params.Phone) {
 			return httpError(http.StatusUnauthorized, ErrorCodeInsufficientAAL, "AAL2 session is required to update email or password when MFA is enabled.")
 		}
 	}