AS1024
/
Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make sure only admins can change password of other users

This commit is contained in:
Frederic Guillot 2017-08-11 21:24:29 -07:00
parent 7a6b1bc3da
commit 88dd6abbf3
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/Controller/UserCredentialController.php
View File

@ -43,6 +43,10 @@ class UserCredentialController extends BaseController
list($valid, $errors) = $this->userValidator->validatePasswordModification($values);
if (! $this->userSession->isAdmin()) {
$values['id'] = $this->userSession->getId();
}
if ($valid) {
if ($this->userModel->update($values)) {
$this->flash->success(t('Password modified successfully.'));

4
app/Validator/UserValidator.php
View File

@ -116,6 +116,10 @@ class UserValidator extends BaseValidator
$v = new Validator($values, array_merge($rules, $this->commonPasswordValidationRules()));
if ($v->execute()) {
if (! $this->userSession->isAdmin() && $values['id'] != $this->userSession->getId()) {
return array(false, array('current_password' => array('Invalid User ID')));
}
if ($this->authenticationManager->passwordAuthentication($this->userSession->getUsername(), $values['current_password'], false)) {
return array(true, array());
} else {