admin/login: fix error message & status code

Signed-off-by: Sumner Evans <[email protected]>
ColoradoSchoolOfMines · Jan 8, 2024 · e583ec8 · e583ec8
1 parent 2e15274
commit e583ec8
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/internal/admin.go b/internal/admin.go
@@ -205,8 +205,8 @@ func (a *Application) HandleAdminLogin(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusBadRequest)
 		return
 	} else if !isAdmin {
-		log.Warn().Err(err).Msg("teacher email not confirmed, not sending login code to avoid amplification attacks")
-		w.WriteHeader(http.StatusBadRequest)
+		log.Warn().Err(err).Msg("user is not an admin, not sending email")
+		w.WriteHeader(http.StatusForbidden)
 		return
 	}