auth: mech-otp - Set lock flag in otp_try_lock()

diff --git a/src/auth/mech-otp.c b/src/auth/mech-otp.c
index 6034f80344016e4ed5bfaba56420496e57dcf797..cc4b37c0dcd3cd771643937898b54b58b9aa4075 100644 (file)
--- a/src/auth/mech-otp.c
+++ b/src/auth/mech-otp.c
@@ -56,6 +56,7 @@ static bool otp_try_lock(struct otp_auth_request *request)
 
        hash_table_insert(otp_lock_table, auth_request->fields.user,
                          auth_request);
+       request->lock = TRUE;
        return TRUE;
 }
 
@@ -96,8 +97,7 @@ otp_send_challenge(struct otp_auth_request *request,
                return;
        }
 
-       request->lock = otp_try_lock(request);
-       if (!request->lock) {
+       if (!otp_try_lock(request)) {
                e_error(auth_request->mech_event,
                        "user is locked, race attack?");
                auth_request_fail(auth_request);