closes #1972

src/middleware/middleware.js

@@ -194,6 +194,15 @@ middleware.isAdmin = function(req, res, next) {
 		}
 
 		if (isAdmin) {
+			user.hasPassword(req.uid, function(err, hasPassword) {
+				if (err) {
+					return next(err);
+				}
+
+				if (!hasPassword) {
+					return next();
+				}
+
 				var loginTime = req.session.meta ? req.session.meta.datetime : 0;
 				if (loginTime && parseInt(loginTime, 10) > Date.now() - 3600000) {
 					return next();
@@ -207,6 +216,7 @@ middleware.isAdmin = function(req, res, next) {
 					res.redirect('/login');
 				}
 				return;
+			});
 		}
 
 		if (res.locals.isAPI) {