Make sure only admins can change password of other users

2017-08-11 21:24:29 -07:00
parent 7a6b1bc3da
commit 88dd6abbf3
2 changed files with 8 additions and 0 deletions
--- a/app/Validator/UserValidator.php
+++ b/app/Validator/UserValidator.php
@@ -116,6 +116,10 @@ class UserValidator extends BaseValidator
        $v = new Validator($values, array_merge($rules, $this->commonPasswordValidationRules()));

        if ($v->execute()) {
+            if (! $this->userSession->isAdmin() && $values['id'] != $this->userSession->getId()) {
+                return array(false, array('current_password' => array('Invalid User ID')));
+            }
+
            if ($this->authenticationManager->passwordAuthentication($this->userSession->getUsername(), $values['current_password'], false)) {
                return array(true, array());
            } else {