From 2f64a2810e14fb990fb7333d257864e67d49acd8 Mon Sep 17 00:00:00 2001 From: James Moger Date: Mon, 17 Jun 2013 15:57:45 -0400 Subject: Disallow credential changes for container authenticated sessions --- src/main/java/com/gitblit/GitBlit.java | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'src/main/java/com/gitblit/GitBlit.java') diff --git a/src/main/java/com/gitblit/GitBlit.java b/src/main/java/com/gitblit/GitBlit.java index 25ffaba8..ef739780 100644 --- a/src/main/java/com/gitblit/GitBlit.java +++ b/src/main/java/com/gitblit/GitBlit.java @@ -681,7 +681,15 @@ public class GitBlit implements ServletContextListener { * @return true if the user service supports credential changes */ public boolean supportsCredentialChanges(UserModel user) { - return (user != null && user.isLocalAccount()) || userService.supportsCredentialChanges(); + if (user == null) { + return false; + } else if (!Constants.EXTERNAL_ACCOUNT.equals(user.password)) { + // credentials likely maintained by Gitblit + return userService.supportsCredentialChanges(); + } else { + // credentials are externally maintained + return false; + } } /** -- cgit v1.2.3