Fix #1318, basic auth is completely disabled if the auth is disabled

server/auth.js

@@ -31,10 +31,6 @@ exports.login = async function (username, password) {
 };
 
 function myAuthorizer(username, password, callback) {
-    setting("disableAuth").then((result) => {
-        if (result) {
-            callback(null, true);
-        } else {
     // Login Rate Limit
     loginRateLimiter.pass(null, 0).then((pass) => {
         if (pass) {
@@ -49,13 +45,27 @@ function myAuthorizer(username, password, callback) {
             callback(null, false);
         }
     });
-
-        }
-    });
 }
 
-exports.basicAuth = basicAuth({
+/**
+ * If disabled auth, it does not call `next`.
+ */
+exports.checkBasicAuth = async (req, res, next) => {
+
+};
+
+exports.basicAuth = async function (req, res, next) {
+    const middleware = basicAuth({
         authorizer: myAuthorizer,
         authorizeAsync: true,
         challenge: true,
-});
+    });
+
+    const disabledAuth = await setting("disableAuth");
+
+    if (!disabledAuth) {
+        middleware(req, res, next);
+    } else {
+        next();
+    }
+};