From 42202eb3895360f6792205bdf3bd7241faea9c50 Mon Sep 17 00:00:00 2001 From: EJSRobinson Date: Wed, 16 Sep 2026 09:43:51 +0100 Subject: [PATCH] fix: scope LOGINDISABLED check to plaintext LOGIN branch The LOGINDISABLED guard was an unconditional early return placed above auth mechanism selection, so servers advertising both AUTH=XOAUTH2 and LOGINDISABLED (e.g. Exchange Online) aborted before the XOAUTH2 branch was reached, even with a valid token configured. Move the check inside the user/password branch so it only blocks plaintext LOGIN. Basic auth behaviour and error message are unchanged; the STARTTLS use of LOGINDISABLED is untouched. --- lib/Connection.js | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/lib/Connection.js b/lib/Connection.js index bd31e98b..0cc9a4aa 100644 --- a/lib/Connection.js +++ b/lib/Connection.js @@ -1654,12 +1654,6 @@ Connection.prototype._login = function() { return; } - if (self.serverSupports('LOGINDISABLED')) { - err = new Error('Logging in is disabled on this server'); - err.source = 'authentication'; - return reentry(err); - } - var cmd; if (self.serverSupports('AUTH=XOAUTH') && self._config.xoauth) { self._caps = undefined; @@ -1675,6 +1669,11 @@ Connection.prototype._login = function() { cmd += ' ' + escape(self._config.xoauth2); self._enqueue(cmd, checkCaps); } else if (self._config.user && self._config.password) { + if (self.serverSupports('LOGINDISABLED')) { + err = new Error('Logging in is disabled on this server'); + err.source = 'authentication'; + return reentry(err); + } self._caps = undefined; self._enqueue('LOGIN "' + escape(self._config.user) + '" "' + escape(self._config.password) + '"', checkCaps);