Fix #1318, basic auth is completely disabled if the auth is disabled

server/auth.js

@@ -31,31 +31,41 @@ exports.login = async function (username, password) {
 };
 
 function myAuthorizer(username, password, callback) {
-    setting("disableAuth").then((result) => {
+    // Login Rate Limit
-        if (result) {
+    loginRateLimiter.pass(null, 0).then((pass) => {
-            callback(null, true);
+        if (pass) {
-        } else {
+            exports.login(username, password).then((user) => {
-            // Login Rate Limit
+                callback(null, user != null);
-            loginRateLimiter.pass(null, 0).then((pass) => {
+
-                if (pass) {
+                if (user == null) {
-                    exports.login(username, password).then((user) => {
+                    loginRateLimiter.removeTokens(1);
-                        callback(null, user != null);
-
-                        if (user == null) {
-                            loginRateLimiter.removeTokens(1);
-                        }
-                    });
-                } else {
-                    callback(null, false);
                 }
             });
-
+        } else {
+            callback(null, false);
         }
     });
 }
 
-exports.basicAuth = basicAuth({
+/**
-    authorizer: myAuthorizer,
+ * If disabled auth, it does not call `next`.
-    authorizeAsync: true,
+ */
-    challenge: true,
+exports.checkBasicAuth = async (req, res, next) => {
-});
+
+};
+
+exports.basicAuth = async function (req, res, next) {
+    const middleware = basicAuth({
+        authorizer: myAuthorizer,
+        authorizeAsync: true,
+        challenge: true,
+    });
+
+    const disabledAuth = await setting("disableAuth");
+
+    if (!disabledAuth) {
+        middleware(req, res, next);
+    } else {
+        next();
+    }
+};