closes #1972

src/middleware/middleware.js

@@ -194,19 +194,29 @@ middleware.isAdmin = function(req, res, next) {
 		}
 
 		if (isAdmin) {
-			var loginTime = req.session.meta ? req.session.meta.datetime : 0;
+			user.hasPassword(req.uid, function(err, hasPassword) {
-			if (loginTime && parseInt(loginTime, 10) > Date.now() - 3600000) {
+				if (err) {
-				return next();
+					return next(err);
-			}
+				}
-
+
-			req.session.returnTo = nconf.get('relative_path') + req.path.replace(/^\/api/, '');
+				if (!hasPassword) {
-			req.session.forceLogin = 1;
+					return next();
-			if (res.locals.isAPI) {
+				}
-				res.status(401).json({});
+
-			} else {
+				var loginTime = req.session.meta ? req.session.meta.datetime : 0;
-				res.redirect('/login');
+				if (loginTime && parseInt(loginTime, 10) > Date.now() - 3600000) {
-			}
+					return next();
-			return;
+				}
+
+				req.session.returnTo = nconf.get('relative_path') + req.path.replace(/^\/api/, '');
+				req.session.forceLogin = 1;
+				if (res.locals.isAPI) {
+					res.status(401).json({});
+				} else {
+					res.redirect('/login');
+				}
+				return;
+			});
 		}
 
 		if (res.locals.isAPI) {