AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make sure only admins can change password of other users

Browse Source
This commit is contained in:
Frederic Guillot
2017-08-11 21:24:29 -07:00
parent 7a6b1bc3da
commit 88dd6abbf3
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/Controller/UserCredentialController.php
View File

@@ -43,6 +43,10 @@ class UserCredentialController extends BaseController
list($valid, $errors) = $this->userValidator->validatePasswordModification($values); list($valid, $errors) = $this->userValidator->validatePasswordModification($values);
if (! $this->userSession->isAdmin()) {
$values['id'] = $this->userSession->getId();
}
if ($valid) { if ($valid) {
if ($this->userModel->update($values)) { if ($this->userModel->update($values)) {
$this->flash->success(t('Password modified successfully.')); $this->flash->success(t('Password modified successfully.'));

4
app/Validator/UserValidator.php
View File

@@ -116,6 +116,10 @@ class UserValidator extends BaseValidator
$v = new Validator($values, array_merge($rules, $this->commonPasswordValidationRules())); $v = new Validator($values, array_merge($rules, $this->commonPasswordValidationRules()));
if ($v->execute()) { if ($v->execute()) {
if (! $this->userSession->isAdmin() && $values['id'] != $this->userSession->getId()) {
return array(false, array('current_password' => array('Invalid User ID')));
}
if ($this->authenticationManager->passwordAuthentication($this->userSession->getUsername(), $values['current_password'], false)) { if ($this->authenticationManager->passwordAuthentication($this->userSession->getUsername(), $values['current_password'], false)) {
return array(true, array()); return array(true, array());
} else { } else {