Adjust permission checks

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

diff --git a/settings/Controller/UsersController.php b/settings/Controller/UsersController.php
index 41f3bac733dea1da86685ee981cfdea748faaf12..fa97845dfba07fbb45504d415c6bfc4360f5c05e 100644 (file)
--- a/settings/Controller/UsersController.php
+++ b/settings/Controller/UsersController.php
@@ -502,8 +502,6 @@ class UsersController extends Controller {
        }
 
        /**
-        * @todo add method description
-        *
         * @NoAdminRequired
         * @NoSubadminRequired
         * @PasswordConfirmationRequired
@@ -673,6 +671,8 @@ class UsersController extends Controller {
         * @PasswordConfirmationRequired
         * @todo merge into saveUserSettings
         *
+        * @NoAdminRequired
+        *
         * @param string $username
         * @param string $displayName
         * @return DataResponse
@@ -681,14 +681,8 @@ class UsersController extends Controller {
                $currentUser = $this->userSession->getUser();
                $user = $this->userManager->get($username);
 
-               if ($user === null ||
-                       !$user->canChangeDisplayName() ||
-                       (
-                               !$this->groupManager->isAdmin($currentUser->getUID()) &&
-                               !$this->groupManager->getSubAdmin()->isUserAccessible($currentUser, $user) &&
-                               $currentUser->getUID() !== $username
-
-                       )
+               if (!$this->groupManager->isAdmin($currentUser->getUID()) &&
+                               !$this->groupManager->getSubAdmin()->isUserAccessible($currentUser, $user)
                ) {
                        return new DataResponse([
                                'status' => 'error',

diff --git a/settings/templates/personal.php b/settings/templates/personal.php
index 519ffa273d93bbe0a61a875b967a47a9450603b3..f5050ab190e0f5404210ba3fe64cd42075f06135 100644 (file)
--- a/settings/templates/personal.php
+++ b/settings/templates/personal.php
@@ -114,7 +114,7 @@ if($_['displayNameChangeSupported']) {
        <div class="personal-settings-setting-box">
                <form id="addressform" class="section">
                        <h2>
-                               <label for="address"><?php echo $l->t('Address'); ?></label>
+                               <label for="address"><?php p($l->t('Address')); ?></label>
                                <span class="icon-password"/>
                        </h2>
                        <input type="text" id="address" name="address"
@@ -233,17 +233,17 @@ if($_['passwordChangeSupported']) {
        <h2 class="inlineblock"><?php p($l->t('Password'));?></h2>
        <div id="password-error-msg" class="msg success inlineblock" style="display: none;">Saved</div>
        <br>
-       <label for="pass1" class="hidden-visually"><?php echo $l->t('Current password');?>: </label>
+       <label for="pass1" class="hidden-visually"><?php p($l->t('Current password')); ?>: </label>
        <input type="password" id="pass1" name="oldpassword"
-               placeholder="<?php echo $l->t('Current password');?>"
+               placeholder="<?php p($l->t('Current password'));?>"
                autocomplete="off" autocapitalize="off" autocorrect="off" />
-       <label for="pass2" class="hidden-visually"><?php echo $l->t('New password');?>: </label>
+       <label for="pass2" class="hidden-visually"><?php p($l->t('New password'));?>: </label>
        <input type="password" id="pass2" name="newpassword"
-               placeholder="<?php echo $l->t('New password');?>"
+               placeholder="<?php p($l->t('New password')); ?>"
                data-typetoggle="#personal-show"
                autocomplete="off" autocapitalize="off" autocorrect="off" />
        <input type="checkbox" id="personal-show" name="show" /><label for="personal-show" class="personal-show-label"></label>
-       <input id="passwordbutton" type="submit" value="<?php echo $l->t('Change password');?>" />
+       <input id="passwordbutton" type="submit" value="<?php p($l->t('Change password')); ?>" />
        <br/>
 </form>
 <?php