From 0ef27187a5ed5321400b43a209f65ae26a79b51c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?=
 <barisusakli@gmail.com>
Date: Fri, 27 Feb 2026 00:34:33 -0500
Subject: [PATCH] fix: dont show /register page after req.session.forceLogin is
 set

repro
1. try to access acp after timeout
2. you get redirected to login
3. try to load /register and you get the /register page even though you are already logged in
---
 src/middleware/user.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/middleware/user.js b/src/middleware/user.js
index 620c4bad9c..b884684047 100644
--- a/src/middleware/user.js
+++ b/src/middleware/user.js
@@ -198,7 +198,7 @@ module.exports = function (middleware) {
 	});
 
 	middleware.redirectToAccountIfLoggedIn = helpers.try(async (req, res, next) => {
-		if (req.session.forceLogin || req.uid <= 0) {
+		if ((req.path === '/login' && req.session.forceLogin) || req.uid <= 0) {
 			return next();
 		}
 		const userslug = await user.getUserField(req.uid, 'userslug');