summaryrefslogtreecommitdiffstats
path: root/settings/ajax
diff options
context:
space:
mode:
authorBart Visscher <bartv@thisnet.nl>2012-10-17 16:38:11 +0200
committerBart Visscher <bartv@thisnet.nl>2012-10-17 16:38:11 +0200
commit6081bfa2bcbe121e373486273ecce58a49e6fa97 (patch)
treef2504800c66919a53eff9323724b493079569495 /settings/ajax
parentc2b4e534534e083147bbad9b564179832cfa2912 (diff)
parent44287d680bd0e8799724a7595db43c0fafcaff40 (diff)
downloadnextcloud-server-6081bfa2bcbe121e373486273ecce58a49e6fa97.tar.gz
nextcloud-server-6081bfa2bcbe121e373486273ecce58a49e6fa97.zip
Merge branch 'master' into routing
Conflicts: lib/search/provider/file.php settings/ajax/changepassword.php settings/settings.php
Diffstat (limited to 'settings/ajax')
-rw-r--r--settings/ajax/changepassword.php21
-rw-r--r--settings/ajax/creategroup.php9
-rw-r--r--settings/ajax/createuser.php8
-rw-r--r--settings/ajax/removeuser.php5
4 files changed, 22 insertions, 21 deletions
diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php
index 200fdec26de..a0fe5947b6d 100644
--- a/settings/ajax/changepassword.php
+++ b/settings/ajax/changepassword.php
@@ -1,15 +1,13 @@
<?php
+// Check if we are a user
OCP\JSON::callCheck();
+OC_JSON::checkLoggedIn();
$username = isset($_POST["username"]) ? $_POST["username"] : OC_User::getUser();
$password = $_POST["password"];
$oldPassword=isset($_POST["oldpassword"])?$_POST["oldpassword"]:'';
-// Check if we are a user
-OC_JSON::checkLoggedIn();
-OCP\JSON::callCheck();
-
$userstatus = null;
if(OC_Group::inGroup(OC_User::getUser(), 'admin')) {
$userstatus = 'admin';
@@ -17,8 +15,15 @@ if(OC_Group::inGroup(OC_User::getUser(), 'admin')) {
if(OC_SubAdmin::isUserAccessible(OC_User::getUser(), $username)) {
$userstatus = 'subadmin';
}
-if(OC_User::getUser() == $username && OC_User::checkPassword($username, $oldPassword)) {
- $userstatus = 'user';
+if(OC_User::getUser() === $username) {
+ if (OC_User::checkPassword($username, $oldPassword))
+ {
+ $userstatus = 'user';
+ } else {
+ if (!OC_Util::isUserVerified()) {
+ $userstatus = null;
+ }
+ }
}
if(is_null($userstatus)) {
@@ -26,6 +31,10 @@ if(is_null($userstatus)) {
exit();
}
+if($userstatus === 'admin' || $userstatus === 'subadmin') {
+ OC_JSON::verifyUser();
+}
+
// Return Success story
if( OC_User::setPassword( $username, $password )) {
OC_JSON::success(array("data" => array( "username" => $username )));
diff --git a/settings/ajax/creategroup.php b/settings/ajax/creategroup.php
index bb3b0620e8a..0a79527c219 100644
--- a/settings/ajax/creategroup.php
+++ b/settings/ajax/creategroup.php
@@ -1,14 +1,7 @@
<?php
OCP\JSON::callCheck();
-
-// Check if we are a user
-if( !OC_User::isLoggedIn() || !OC_Group::inGroup( OC_User::getUser(), 'admin' )) {
- OC_JSON::error(array("data" => array( "message" => $l->t("Authentication error") )));
- exit();
-}
-
-OCP\JSON::callCheck();
+OC_JSON::checkAdminUser();
$groupname = $_POST["groupname"];
diff --git a/settings/ajax/createuser.php b/settings/ajax/createuser.php
index 49fc0e0f53b..c87ff422f61 100644
--- a/settings/ajax/createuser.php
+++ b/settings/ajax/createuser.php
@@ -1,13 +1,7 @@
<?php
OCP\JSON::callCheck();
-
-// Check if we are a user
-if( !OC_User::isLoggedIn() || (!OC_Group::inGroup( OC_User::getUser(), 'admin' ) && !OC_SubAdmin::isSubAdmin(OC_User::getUser()))) {
- OC_JSON::error(array("data" => array( "message" => "Authentication error" )));
- exit();
-}
-OCP\JSON::callCheck();
+OC_JSON::checkSubAdminUser();
$isadmin = OC_Group::inGroup(OC_User::getUser(), 'admin')?true:false;
diff --git a/settings/ajax/removeuser.php b/settings/ajax/removeuser.php
index a10dc29321d..9ffb32a0b23 100644
--- a/settings/ajax/removeuser.php
+++ b/settings/ajax/removeuser.php
@@ -5,6 +5,11 @@ OCP\JSON::callCheck();
$username = $_POST["username"];
+// A user shouldn't be able to delete his own account
+if(OC_User::getUser() === $username) {
+ exit;
+}
+
if(!OC_Group::inGroup(OC_User::getUser(), 'admin') && !OC_SubAdmin::isUserAccessible(OC_User::getUser(), $username)) {
$l = OC_L10N::get('core');
OC_JSON::error(array( 'data' => array( 'message' => $l->t('Authentication error') )));