Merge branch 'master' into routing

Conflicts:
	lib/search/provider/file.php
	settings/ajax/changepassword.php
	settings/settings.php

1 files changed, 15 insertions, 6 deletions

diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php
index 200fdec26de..a0fe5947b6d 100644
--- a/settings/ajax/changepassword.php
+++ b/settings/ajax/changepassword.php
@@ -1,15 +1,13 @@
 <?php
 
+// Check if we are a user
 OCP\JSON::callCheck();
+OC_JSON::checkLoggedIn();
 
 $username = isset($_POST["username"]) ? $_POST["username"] : OC_User::getUser();
 $password = $_POST["password"];
 $oldPassword=isset($_POST["oldpassword"])?$_POST["oldpassword"]:'';
 
-// Check if we are a user
-OC_JSON::checkLoggedIn();
-OCP\JSON::callCheck();
-
 $userstatus = null;
 if(OC_Group::inGroup(OC_User::getUser(), 'admin')) {
 	$userstatus = 'admin';
@@ -17,8 +15,15 @@ if(OC_Group::inGroup(OC_User::getUser(), 'admin')) {
 if(OC_SubAdmin::isUserAccessible(OC_User::getUser(), $username)) {
 	$userstatus = 'subadmin';
 }
-if(OC_User::getUser() == $username && OC_User::checkPassword($username, $oldPassword)) {
-	$userstatus = 'user';
+if(OC_User::getUser() === $username) {
+	if (OC_User::checkPassword($username, $oldPassword))
+	{
+		$userstatus = 'user';
+	}  else {
+		if (!OC_Util::isUserVerified()) {
+			$userstatus = null;
+		}
+	}
 }
 
 if(is_null($userstatus)) {
@@ -26,6 +31,10 @@ if(is_null($userstatus)) {
 	exit();
 }
 
+if($userstatus === 'admin' || $userstatus === 'subadmin') {
+	OC_JSON::verifyUser();
+}
+
 // Return Success story
 if( OC_User::setPassword( $username, $password )) {
 	OC_JSON::success(array("data" => array( "username" => $username )));