diff options
| author | Lukas Reschke <lukas@statuscode.ch> | 2012-10-15 16:26:34 +0200 |
|---|---|---|
| committer | Daniel Molkentin <daniel@molkentin.de> | 2012-10-15 17:42:38 +0200 |
| commit | 4d7b0e9bb3d39d40af2bab9dc891226f7fbb591d (patch) | |
| tree | 51ad9d4b5c9fd51db474dbbde9c575c5aad1f403 /lib/json.php | |
| parent | d33bec09fe1da810f0a7f60d9b6a61e513ce0b2f (diff) | |
| download | nextcloud-server-4d7b0e9bb3d39d40af2bab9dc891226f7fbb591d.tar.gz nextcloud-server-4d7b0e9bb3d39d40af2bab9dc891226f7fbb591d.zip | |
verifyUser() for the json part
Diffstat (limited to 'lib/json.php')
| -rw-r--r-- | lib/json.php | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/lib/json.php b/lib/json.php index 518c3c87c49..89509710745 100644 --- a/lib/json.php +++ b/lib/json.php @@ -58,7 +58,7 @@ class OC_JSON{ */ public static function checkAdminUser() { self::checkLoggedIn(); - if( !OC_Group::inGroup( OC_User::getUser(), 'admin' )) { + if( !OC_Group::inGroup( OC_User::getUser(), 'admin' ) || self::verifyUser() === false) { $l = OC_L10N::get('lib'); self::error(array( 'data' => array( 'message' => $l->t('Authentication error') ))); exit(); @@ -70,7 +70,7 @@ class OC_JSON{ */ public static function checkSubAdminUser() { self::checkLoggedIn(); - if(!OC_Group::inGroup(OC_User::getUser(),'admin') && !OC_SubAdmin::isSubAdmin(OC_User::getUser())) { + if(!OC_Group::inGroup(OC_User::getUser(),'admin') && !OC_SubAdmin::isSubAdmin(OC_User::getUser()) || self::verifyUser() === false) { $l = OC_L10N::get('lib'); self::error(array( 'data' => array( 'message' => $l->t('Authentication error') ))); exit(); @@ -78,6 +78,18 @@ class OC_JSON{ } /** + * Check if the user verified the login with his password in the last 15 minutes + * @return bool + */ + public static function verifyUser() { + // Check if the user verified his password in the last 15 minutes + if($_SESSION['verifiedLogin'] < time() OR !isset($_SESSION['verifiedLogin'])) { + return false; + } + return true; + } + + /** * Send json error msg */ public static function error($data = array()) { |