diff options
author | Bart Visscher <bartv@thisnet.nl> | 2012-10-17 16:38:11 +0200 |
---|---|---|
committer | Bart Visscher <bartv@thisnet.nl> | 2012-10-17 16:38:11 +0200 |
commit | 6081bfa2bcbe121e373486273ecce58a49e6fa97 (patch) | |
tree | f2504800c66919a53eff9323724b493079569495 /settings/ajax | |
parent | c2b4e534534e083147bbad9b564179832cfa2912 (diff) | |
parent | 44287d680bd0e8799724a7595db43c0fafcaff40 (diff) | |
download | nextcloud-server-6081bfa2bcbe121e373486273ecce58a49e6fa97.tar.gz nextcloud-server-6081bfa2bcbe121e373486273ecce58a49e6fa97.zip |
Merge branch 'master' into routing
Conflicts:
lib/search/provider/file.php
settings/ajax/changepassword.php
settings/settings.php
Diffstat (limited to 'settings/ajax')
-rw-r--r-- | settings/ajax/changepassword.php | 21 | ||||
-rw-r--r-- | settings/ajax/creategroup.php | 9 | ||||
-rw-r--r-- | settings/ajax/createuser.php | 8 | ||||
-rw-r--r-- | settings/ajax/removeuser.php | 5 |
4 files changed, 22 insertions, 21 deletions
diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php index 200fdec26de..a0fe5947b6d 100644 --- a/settings/ajax/changepassword.php +++ b/settings/ajax/changepassword.php @@ -1,15 +1,13 @@ <?php +// Check if we are a user OCP\JSON::callCheck(); +OC_JSON::checkLoggedIn(); $username = isset($_POST["username"]) ? $_POST["username"] : OC_User::getUser(); $password = $_POST["password"]; $oldPassword=isset($_POST["oldpassword"])?$_POST["oldpassword"]:''; -// Check if we are a user -OC_JSON::checkLoggedIn(); -OCP\JSON::callCheck(); - $userstatus = null; if(OC_Group::inGroup(OC_User::getUser(), 'admin')) { $userstatus = 'admin'; @@ -17,8 +15,15 @@ if(OC_Group::inGroup(OC_User::getUser(), 'admin')) { if(OC_SubAdmin::isUserAccessible(OC_User::getUser(), $username)) { $userstatus = 'subadmin'; } -if(OC_User::getUser() == $username && OC_User::checkPassword($username, $oldPassword)) { - $userstatus = 'user'; +if(OC_User::getUser() === $username) { + if (OC_User::checkPassword($username, $oldPassword)) + { + $userstatus = 'user'; + } else { + if (!OC_Util::isUserVerified()) { + $userstatus = null; + } + } } if(is_null($userstatus)) { @@ -26,6 +31,10 @@ if(is_null($userstatus)) { exit(); } +if($userstatus === 'admin' || $userstatus === 'subadmin') { + OC_JSON::verifyUser(); +} + // Return Success story if( OC_User::setPassword( $username, $password )) { OC_JSON::success(array("data" => array( "username" => $username ))); diff --git a/settings/ajax/creategroup.php b/settings/ajax/creategroup.php index bb3b0620e8a..0a79527c219 100644 --- a/settings/ajax/creategroup.php +++ b/settings/ajax/creategroup.php @@ -1,14 +1,7 @@ <?php OCP\JSON::callCheck(); - -// Check if we are a user -if( !OC_User::isLoggedIn() || !OC_Group::inGroup( OC_User::getUser(), 'admin' )) { - OC_JSON::error(array("data" => array( "message" => $l->t("Authentication error") ))); - exit(); -} - -OCP\JSON::callCheck(); +OC_JSON::checkAdminUser(); $groupname = $_POST["groupname"]; diff --git a/settings/ajax/createuser.php b/settings/ajax/createuser.php index 49fc0e0f53b..c87ff422f61 100644 --- a/settings/ajax/createuser.php +++ b/settings/ajax/createuser.php @@ -1,13 +1,7 @@ <?php OCP\JSON::callCheck(); - -// Check if we are a user -if( !OC_User::isLoggedIn() || (!OC_Group::inGroup( OC_User::getUser(), 'admin' ) && !OC_SubAdmin::isSubAdmin(OC_User::getUser()))) { - OC_JSON::error(array("data" => array( "message" => "Authentication error" ))); - exit(); -} -OCP\JSON::callCheck(); +OC_JSON::checkSubAdminUser(); $isadmin = OC_Group::inGroup(OC_User::getUser(), 'admin')?true:false; diff --git a/settings/ajax/removeuser.php b/settings/ajax/removeuser.php index a10dc29321d..9ffb32a0b23 100644 --- a/settings/ajax/removeuser.php +++ b/settings/ajax/removeuser.php @@ -5,6 +5,11 @@ OCP\JSON::callCheck(); $username = $_POST["username"]; +// A user shouldn't be able to delete his own account +if(OC_User::getUser() === $username) { + exit; +} + if(!OC_Group::inGroup(OC_User::getUser(), 'admin') && !OC_SubAdmin::isUserAccessible(OC_User::getUser(), $username)) { $l = OC_L10N::get('core'); OC_JSON::error(array( 'data' => array( 'message' => $l->t('Authentication error') ))); |