Verify password page for users

1 files changed, 19 insertions, 0 deletions

diff --git a/lib/util.php b/lib/util.php
index 9a3bf162062..b92f97b0375 100755
--- a/lib/util.php
+++ b/lib/util.php
@@ -361,6 +361,7 @@ class OC_Util {
 	public static function checkAdminUser() {
 		// Check if we are a user
 		self::checkLoggedIn();
+		self::verifyUser();
 		if( !OC_Group::inGroup( OC_User::getUser(), 'admin' )) {
 			header( 'Location: '.OC_Helper::linkToAbsolute( '', 'index.php' ));
 			exit();
@@ -374,6 +375,7 @@ class OC_Util {
 	public static function checkSubAdminUser() {
 		// Check if we are a user
 		self::checkLoggedIn();
+		self::verifyUser();
 		if(OC_Group::inGroup(OC_User::getUser(),'admin')) {
 			return true;
 		}
@@ -385,6 +387,23 @@ class OC_Util {
 	}
 
 	/**
+	* Check if the user verified the login with his password in the last 15 minutes
+	* If not, the user will be shown a password verification page
+	*/
+	public static function verifyUser() {
+		// Check password to set session
+		if (OC_User::login(OC_User::getUser(), $_POST["password"] ) === true) {
+			$_SESSION['verifiedLogin']=time() + (15 * 60);
+		}
+
+		// Check if the user verified his password in the last 15 minutes
+		if($_SESSION['verifiedLogin'] < time() OR !isset($_SESSION['verifiedLogin'])) {
+			OC_Template::printGuestPage("", "verify",  array('username' => OC_User::getUser()));
+			exit();
+		}
+	}
+
+	/**
 	* Redirect to the user default page
 	*/
 	public static function redirectToDefaultPage() {