Merge pull request #1447 from nextcloud/password-confirmation-for-some-actions

Password confirmation for some actions

14 files changed, 271 insertions, 95 deletions

diff --git a/settings/Controller/AuthSettingsController.php b/settings/Controller/AuthSettingsController.php
index 2a4b30dbd76..57192e119a9 100644
--- a/settings/Controller/AuthSettingsController.php
+++ b/settings/Controller/AuthSettingsController.php
@@ -111,7 +111,9 @@ class AuthSettingsController extends Controller {
 	/**
 	 * @NoAdminRequired
 	 * @NoSubadminRequired
+	 * @PasswordConfirmationRequired
 	 *
+	 * @param string $name
 	 * @return JSONResponse
 	 */
 	public function create($name) {
@@ -138,11 +140,11 @@ class AuthSettingsController extends Controller {
 		$tokenData = $deviceToken->jsonSerialize();
 		$tokenData['canDelete'] = true;
 
-		return [
+		return new JSONResponse([
 			'token' => $token,
 			'loginName' => $loginName,
-			'deviceToken' => $tokenData
-		];
+			'deviceToken' => $tokenData,
+		]);
 	}
 
 	private function getServiceNotAvailableResponse() {
diff --git a/settings/Controller/ChangePasswordController.php b/settings/Controller/ChangePasswordController.php
index e43d0d8f343..832cdbefdbe 100644
--- a/settings/Controller/ChangePasswordController.php
+++ b/settings/Controller/ChangePasswordController.php
@@ -131,6 +131,7 @@ class ChangePasswordController extends Controller {
 
 	/**
 	 * @NoAdminRequired
+	 * @PasswordConfirmationRequired
 	 *
 	 * @param string $username
 	 * @param string $password
diff --git a/settings/Controller/GroupsController.php b/settings/Controller/GroupsController.php
index feed45b118e..8985a76ec95 100644
--- a/settings/Controller/GroupsController.php
+++ b/settings/Controller/GroupsController.php
@@ -95,6 +95,7 @@ class GroupsController extends Controller {
 	}
 
 	/**
+	 * @PasswordConfirmationRequired
 	 * @param string $id
 	 * @return DataResponse
 	 */
@@ -128,6 +129,7 @@ class GroupsController extends Controller {
 	}
 
 	/**
+	 * @PasswordConfirmationRequired
 	 * @param string $id
 	 * @return DataResponse
 	 */
diff --git a/settings/Controller/MailSettingsController.php b/settings/Controller/MailSettingsController.php
index 84423aa8e29..108ac3f393a 100644
--- a/settings/Controller/MailSettingsController.php
+++ b/settings/Controller/MailSettingsController.php
@@ -73,6 +73,9 @@ class MailSettingsController extends Controller {
 
 	/**
 	 * Sets the email settings
+	 *
+	 * @PasswordConfirmationRequired
+	 *
 	 * @param string $mail_domain
 	 * @param string $mail_from_address
 	 * @param string $mail_smtpmode
@@ -116,6 +119,9 @@ class MailSettingsController extends Controller {
 
 	/**
 	 * Store the credentials used for SMTP in the config
+	 *
+	 * @PasswordConfirmationRequired
+	 *
 	 * @param string $mail_smtpname
 	 * @param string $mail_smtppassword
 	 * @return array
diff --git a/settings/Controller/UsersController.php b/settings/Controller/UsersController.php
index fde29de3598..89831a66aba 100644
--- a/settings/Controller/UsersController.php
+++ b/settings/Controller/UsersController.php
@@ -301,6 +301,7 @@ class UsersController extends Controller {
 
 	/**
 	 * @NoAdminRequired
+	 * @PasswordConfirmationRequired
 	 *
 	 * @param string $username
 	 * @param string $password
@@ -433,6 +434,7 @@ class UsersController extends Controller {
 
 	/**
 	 * @NoAdminRequired
+	 * @PasswordConfirmationRequired
 	 *
 	 * @param string $id
 	 * @return DataResponse
@@ -495,6 +497,7 @@ class UsersController extends Controller {
 	 *
 	 * @NoAdminRequired
 	 * @NoSubadminRequired
+	 * @PasswordConfirmationRequired
 	 *
 	 * @param string $id
 	 * @param string $mailAddress
@@ -615,6 +618,7 @@ class UsersController extends Controller {
 	 *
 	 * @NoAdminRequired
 	 * @NoSubadminRequired
+	 * @PasswordConfirmationRequired
 	 *
 	 * @param string $username
 	 * @param string $displayName
diff --git a/settings/ajax/setquota.php b/settings/ajax/setquota.php
index eee1de407b9..0906102ec20 100644
--- a/settings/ajax/setquota.php
+++ b/settings/ajax/setquota.php
@@ -32,6 +32,13 @@
 OC_JSON::checkSubAdminUser();
 OCP\JSON::callCheck();
 
+$lastConfirm = (int) \OC::$server->getSession()->get('last-password-confirm');
+if ($lastConfirm < (time() - 30 * 60 + 15)) { // allow 15 seconds delay
+	$l = \OC::$server->getL10N('core');
+	OC_JSON::error(array( 'data' => array( 'message' => $l->t('Password confirmation is required'))));
+	exit();
+}
+
 $username = isset($_POST["username"]) ? (string)$_POST["username"] : '';
 
 $isUserAccessible = false;
diff --git a/settings/ajax/togglegroups.php b/settings/ajax/togglegroups.php
index ff79861b811..b9958bef0c9 100644
--- a/settings/ajax/togglegroups.php
+++ b/settings/ajax/togglegroups.php
@@ -28,6 +28,13 @@
 OC_JSON::checkSubAdminUser();
 OCP\JSON::callCheck();
 
+$lastConfirm = (int) \OC::$server->getSession()->get('last-password-confirm');
+if ($lastConfirm < (time() - 30 * 60 + 15)) { // allow 15 seconds delay
+	$l = \OC::$server->getL10N('core');
+	OC_JSON::error(array( 'data' => array( 'message' => $l->t('Password confirmation is required'))));
+	exit();
+}
+
 $success = true;
 $username = (string)$_POST['username'];
 $group = (string)$_POST['group'];
diff --git a/settings/ajax/togglesubadmins.php b/settings/ajax/togglesubadmins.php
index 390e5c09ef3..5658a382410 100644
--- a/settings/ajax/togglesubadmins.php
+++ b/settings/ajax/togglesubadmins.php
@@ -24,6 +24,13 @@
 OC_JSON::checkAdminUser();
 OCP\JSON::callCheck();
 
+$lastConfirm = (int) \OC::$server->getSession()->get('last-password-confirm');
+if ($lastConfirm < (time() - 30 * 60 + 15)) { // allow 15 seconds delay
+	$l = \OC::$server->getL10N('core');
+	OC_JSON::error(array( 'data' => array( 'message' => $l->t('Password confirmation is required'))));
+	exit();
+}
+
 $username = (string)$_POST['username'];
 $group = (string)$_POST['group'];
 
diff --git a/settings/js/admin.js b/settings/js/admin.js
index 7c2b507280f..094b12b2bab 100644
--- a/settings/js/admin.js
+++ b/settings/js/admin.js
@@ -172,21 +172,48 @@ $(document).ready(function(){
 		}
 	});
 
-	$('#mail_general_settings_form').change(function(){
+	var changeEmailSettings = function() {
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(changeEmailSettings);
+			return;
+		}
+
 		OC.msg.startSaving('#mail_settings_msg');
-		var post = $( "#mail_general_settings_form" ).serialize();
-		$.post(OC.generateUrl('/settings/admin/mailsettings'), post, function(data){
-			OC.msg.finishedSaving('#mail_settings_msg', data);
+		$.ajax({
+			url: OC.generateUrl('/settings/admin/mailsettings'),
+			type: 'POST',
+			data: $('#mail_general_settings_form').serialize(),
+			success: function(data){
+				OC.msg.finishedSaving('#mail_settings_msg', data);
+			},
+			error: function(data){
+				OC.msg.finishedError('#mail_settings_msg', data.responseJSON.message);
+			}
 		});
-	});
+	};
+
+	var toggleEmailCredentials = function() {
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(toggleEmailCredentials);
+			return;
+		}
 
-	$('#mail_credentials_settings_submit').click(function(){
 		OC.msg.startSaving('#mail_settings_msg');
-		var post = $( "#mail_credentials_settings" ).serialize();
-		$.post(OC.generateUrl('/settings/admin/mailsettings/credentials'), post, function(data){
-			OC.msg.finishedSaving('#mail_settings_msg', data);
+		$.ajax({
+			url: OC.generateUrl('/settings/admin/mailsettings/credentials'),
+			type: 'POST',
+			data: $('#mail_credentials_settings').serialize(),
+			success: function(data){
+				OC.msg.finishedSaving('#mail_settings_msg', data);
+			},
+			error: function(data){
+				OC.msg.finishedError('#mail_settings_msg', data.responseJSON.message);
+			}
 		});
-	});
+	};
+
+	$('#mail_general_settings_form').change(changeEmailSettings);
+	$('#mail_credentials_settings_submit').click(toggleEmailCredentials);
 
 	$('#sendtestemail').click(function(event){
 		event.preventDefault();
diff --git a/settings/js/authtoken_view.js b/settings/js/authtoken_view.js
index d8537c415ce..24593a04f53 100644
--- a/settings/js/authtoken_view.js
+++ b/settings/js/authtoken_view.js
@@ -299,6 +299,11 @@
 		},
 
 		_addAppPassword: function () {
+			if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+				OC.PasswordConfirmation.requirePasswordConfirmation(_.bind(this._addAppPassword, this));
+				return;
+			}
+
 			var _this = this;
 			this._toggleAddingToken(true);
 
diff --git a/settings/js/personal.js b/settings/js/personal.js
index aef67f719c0..c2cb437bd13 100644
--- a/settings/js/personal.js
+++ b/settings/js/personal.js
@@ -65,7 +65,7 @@ function changeEmailAddress () {
 		//              for failure the first parameter is the result object
 		OC.msg.finishedSaving('#lostpassword .msg', result);
 	}).fail(function(result){
-		OC.msg.finishedSaving('#lostpassword .msg', result.responseJSON);
+		OC.msg.finishedError('#lostpassword .msg', result.responseJSON.message);
 	});
 }
 
diff --git a/settings/js/users/groups.js b/settings/js/users/groups.js
index 8f4d95432a8..cfe01c17530 100644
--- a/settings/js/users/groups.js
+++ b/settings/js/users/groups.js
@@ -128,6 +128,11 @@ GroupList = {
 	},
 
 	createGroup: function (groupname) {
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(_.bind(this.createGroup, this, groupname));
+			return;
+		}
+
 		$.post(
 			OC.generateUrl('/settings/users/groups'),
 			{
@@ -278,10 +283,16 @@ GroupList = {
 			GroupList.show);
 
 		//when to mark user for delete
-		$userGroupList.on('click', '.delete', function () {
+		var deleteAction = function () {
+			if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+				OC.PasswordConfirmation.requirePasswordConfirmation(_.bind(deleteAction, this));
+				return;
+			}
+
 			// Call function for handling delete/undo
 			GroupDeleteHandler.mark(GroupList.getElementGID(this));
-		});
+		};
+		$userGroupList.on('click', '.delete', deleteAction);
 
 		//delete a marked user when leaving the page
 		$(window).on('beforeunload', function () {
diff --git a/settings/js/users/users.js b/settings/js/users/users.js
index 3a357c0e9c4..7e70d98f091 100644
--- a/settings/js/users/users.js
+++ b/settings/js/users/users.js
@@ -353,6 +353,14 @@ var UserList = {
 		$userListBody.on('click', '.delete', function () {
 			// Call function for handling delete/undo
 			var uid = UserList.getUID(this);
+
+			if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+				OC.PasswordConfirmation.requirePasswordConfirmation(function() {
+					UserDeleteHandler.mark(uid);
+				});
+				return;
+			}
+
 			UserDeleteHandler.mark(uid);
 		});
 
@@ -405,6 +413,11 @@ var UserList = {
 	},
 
 	applyGroupSelect: function (element, user, checked) {
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(_.bind(this.applySubadminSelect, this, element, user, checked));
+			return;
+		}
+
 		var $element = $(element);
 
 		var checkHandler = null;
@@ -467,6 +480,11 @@ var UserList = {
 	},
 
 	applySubadminSelect: function (element, user, checked) {
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(_.bind(this.applySubadminSelect, this, element, user, checked));
+			return;
+		}
+
 		var $element = $(element);
 		var checkHandler = function (group) {
 			if (group === 'admin') {
@@ -478,7 +496,10 @@ var UserList = {
 					username: user,
 					group: group
 				},
-				function () {
+				function (response) {
+					if (response.data.message) {
+						OC.Notification.show(response.data.message);
+					}
 				}
 			);
 		};
@@ -518,7 +539,7 @@ var UserList = {
 			OC.Notification.showTemporary(t('core', 'Invalid quota value "{val}"', {val: quota}));
 			return;
 		}
-		UserList._updateQuota(uid, quota, function(returnedQuota){
+		UserList._updateQuota(uid, quota, function(returnedQuota) {
 			if (quota !== returnedQuota) {
 				$select.find(':selected').text(returnedQuota);
 			}
@@ -532,12 +553,21 @@ var UserList = {
 	 * @param {Function} ready callback after save
 	 */
 	_updateQuota: function(uid, quota, ready) {
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(_.bind(this._updateQuota, this, uid, quota, ready));
+			return;
+		}
+
 		$.post(
 			OC.filePath('settings', 'ajax', 'setquota.php'),
 			{username: uid, quota: quota},
 			function (result) {
-				if (ready) {
-					ready(result.data.quota);
+				if (result.status === 'error') {
+					OC.Notification.showTemporary(result.data.message);
+				} else {
+					if (ready) {
+						ready(result.data.quota);
+					}
 				}
 			}
 		);
@@ -635,6 +665,28 @@ $(document).ready(function () {
 	// TODO: move other init calls inside of initialize
 	UserList.initialize($('#userlist'));
 
+	var _submitPasswordChange = function(uid, password, recoveryPasswordVal, blurFunction) {
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(function() {
+				_submitPasswordChange(uid, password, recoveryPasswordVal, blurFunction);
+			});
+			return;
+		}
+
+		$.post(
+			OC.generateUrl('/settings/users/changepassword'),
+			{username: uid, password: password, recoveryPassword: recoveryPasswordVal},
+			function (result) {
+				blurFunction();
+				if (result.status === 'success') {
+					OC.Notification.showTemporary(t('admin', 'Password successfully changed'));
+				} else {
+					OC.Notification.showTemporary(t('admin', result.data.message));
+				}
+			}
+		).fail(blurFunction);
+	};
+
 	$userListBody.on('click', '.password', function (event) {
 		event.stopPropagation();
 
@@ -643,6 +695,12 @@ $(document).ready(function () {
 		var uid = UserList.getUID($td);
 		var $input = $('<input type="password">');
 		var isRestoreDisabled = UserList.getRestoreDisabled($td) === true;
+		var blurFunction = function () {
+			$(this).replaceWith($('<span>●●●●●●●</span>'));
+			$td.find('img').show();
+			// remove highlight class from users without recovery ability
+			$tr.removeClass('row-warning');
+		};
 		if(isRestoreDisabled) {
 			$tr.addClass('row-warning');
 			// add tipsy if the password change could cause data loss - no recovery enabled
@@ -657,34 +715,51 @@ $(document).ready(function () {
 				if (event.keyCode === 13) {
 					if ($(this).val().length > 0) {
 						var recoveryPasswordVal = $('input:password[id="recoveryPassword"]').val();
-						$.post(
-							OC.generateUrl('/settings/users/changepassword'),
-							{username: uid, password: $(this).val(), recoveryPassword: recoveryPasswordVal},
-							function (result) {
-								if (result.status === 'success') {
-									OC.Notification.showTemporary(t('admin', 'Password successfully changed'));
-								} else {
-									OC.Notification.showTemporary(t('admin', result.data.message));
-								}
-							}
-						);
-						$input.blur();
+						$input.off('blur');
+						_submitPasswordChange(uid, $(this).val(), recoveryPasswordVal, blurFunction);
 					} else {
 						$input.blur();
 					}
 				}
 			})
-			.blur(function () {
-				$(this).replaceWith($('<span>●●●●●●●</span>'));
-				$td.find('img').show();
-				// remove highlight class from users without recovery ability
-				$tr.removeClass('row-warning');
-			});
+			.blur(blurFunction);
 	});
 	$('input:password[id="recoveryPassword"]').keyup(function() {
 		OC.Notification.hide();
 	});
 
+	var _submitDisplayNameChange = function($tr, uid, displayName, blurFunction) {
+		var $div = $tr.find('div.avatardiv');
+		if ($div.length) {
+			$div.imageplaceholder(uid, displayName);
+		}
+
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(function() {
+				_submitDisplayNameChange($tr, uid, displayName, blurFunction);
+			});
+			return;
+		}
+
+		$.ajax({
+			type: 'POST',
+			url: OC.generateUrl('/settings/users/{id}/displayName', {id: uid}),
+			data: {
+				username: uid,
+				displayName: displayName
+			}
+		}).success(function (result) {
+			if (result && result.status==='success' && $div.length){
+				$div.avatar(result.data.username, 32);
+			}
+			$tr.data('displayname', displayName);
+			blurFunction();
+		}).fail(function (result) {
+			OC.Notification.showTemporary(result.responseJSON.message);
+			$tr.find('.displayName input').blur(blurFunction);
+		});
+	};
+
 	$userListBody.on('click', '.displayName', function (event) {
 		event.stopPropagation();
 		var $td = $(this).closest('td');
@@ -692,6 +767,11 @@ $(document).ready(function () {
 		var uid = UserList.getUID($td);
 		var displayName = escapeHTML(UserList.getDisplayName($td));
 		var $input = $('<input type="text" value="' + displayName + '">');
+		var blurFunction = function() {
+			var displayName = $tr.data('displayname');
+			$input.replaceWith('<span>' + escapeHTML(displayName) + '</span>');
+			$td.find('img').show();
+		};
 		$td.find('img').hide();
 		$td.children('span').replaceWith($input);
 		$input
@@ -699,34 +779,53 @@ $(document).ready(function () {
 			.keypress(function (event) {
 				if (event.keyCode === 13) {
 					if ($(this).val().length > 0) {
-						var $div = $tr.find('div.avatardiv');
-						if ($div.length) {
-							$div.imageplaceholder(uid, displayName);
-						}
-						$.post(
-							OC.generateUrl('/settings/users/{id}/displayName', {id: uid}),
-							{username: uid, displayName: $(this).val()},
-							function (result) {
-								if (result && result.status==='success' && $div.length){
-									$div.avatar(result.data.username, 32);
-								}
-							}
-						);
-						var displayName = $input.val();
-						$tr.data('displayname', displayName);
-						$input.blur();
+						$input.off('blur');
+						_submitDisplayNameChange($tr, uid, $(this).val(), blurFunction);
 					} else {
 						$input.blur();
 					}
 				}
 			})
-			.blur(function () {
-				var displayName = $tr.data('displayname');
-				$input.replaceWith('<span>' + escapeHTML(displayName) + '</span>');
-				$td.find('img').show();
-			});
+			.blur(blurFunction);
 	});
 
+	var _submitEmailChange = function($tr, $td, $input, uid, mailAddress, blurFunction) {
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(function() {
+				_submitEmailChange($tr, $td, $input, uid, mailAddress, blurFunction);
+			});
+			return;
+		}
+
+		$.ajax({
+			type: 'PUT',
+			url: OC.generateUrl('/settings/users/{id}/mailAddress', {id: uid}),
+			data: {
+				mailAddress: mailAddress
+			}
+		}).success(function () {
+			// set data attribute to new value
+			// will in blur() be used to show the text instead of the input field
+			$tr.data('mailAddress', mailAddress);
+			$td.find('.loading-small').css('display', '');
+			$input.removeAttr('disabled')
+				.triggerHandler('blur'); // needed instead of $input.blur() for Firefox
+			blurFunction();
+		}).fail(function (result) {
+			if (!_.isUndefined(result.responseJSON.data)) {
+				OC.Notification.showTemporary(result.responseJSON.data.message);
+			} else if (!_.isUndefined(result.responseJSON.message)) {
+				OC.Notification.showTemporary(result.responseJSON.message);
+			} else {
+				OC.Notification.showTemporary(t('settings', 'Could not change the users email'));
+			}
+			$td.find('.loading-small').css('display', '');
+			$input.removeAttr('disabled')
+				.css('padding-right', '6px');
+			$input.blur(blurFunction);
+		});
+	};
+
 	$userListBody.on('click', '.mailAddress', function (event) {
 		event.stopPropagation();
 		var $td = $(this).closest('td');
@@ -734,6 +833,15 @@ $(document).ready(function () {
 		var uid = UserList.getUID($td);
 		var mailAddress = escapeHTML(UserList.getMailAddress($td));
 		var $input = $('<input type="text">').val(mailAddress);
+		var blurFunction = function() {
+			if($td.find('.loading-small').css('display') === 'inline-block') {
+				// in Chrome the blur event is fired too early by the browser - even if the request is still running
+				return;
+			}
+			var $span = $('<span>').text($tr.data('mailAddress'));
+			$input.replaceWith($span);
+			$td.find('img').show();
+		};
 		$td.children('span').replaceWith($input);
 		$td.find('img').hide();
 		$input
@@ -742,40 +850,14 @@ $(document).ready(function () {
 				if (event.keyCode === 13) {
 					// enter key
 
-					var mailAddress = $input.val();
 					$td.find('.loading-small').css('display', 'inline-block');
 					$input.css('padding-right', '26px');
 					$input.attr('disabled', 'disabled');
-					$.ajax({
-						type: 'PUT',
-						url: OC.generateUrl('/settings/users/{id}/mailAddress', {id: uid}),
-						data: {
-							mailAddress: $(this).val()
-						}
-					}).success(function () {
-						// set data attribute to new value
-						// will in blur() be used to show the text instead of the input field
-						$tr.data('mailAddress', mailAddress);
-						$td.find('.loading-small').css('display', '');
-						$input.removeAttr('disabled')
-							.triggerHandler('blur'); // needed instead of $input.blur() for Firefox
-					}).fail(function (result) {
-						OC.Notification.showTemporary(result.responseJSON.data.message);
-						$td.find('.loading-small').css('display', '');
-						$input.removeAttr('disabled')
-							.css('padding-right', '6px');
-					});
+					$input.off('blur');
+					_submitEmailChange($tr, $td, $input, uid, $(this).val(), blurFunction);
 				}
 			})
-			.blur(function () {
-				if($td.find('.loading-small').css('display') === 'inline-block') {
-					// in Chrome the blur event is fired too early by the browser - even if the request is still running
-					return;
-				}
-				var $span = $('<span>').text($tr.data('mailAddress'));
-				$input.replaceWith($span);
-				$td.find('img').show();
-			});
+			.blur(blurFunction);
 	});
 
 	$('#newuser .groupsListContainer').on('click', function (event) {
@@ -796,8 +878,15 @@ $(document).ready(function () {
 	});
 
 	UserList._updateGroupListLabel($('#newuser .groups'), []);
-	$('#newuser').submit(function (event) {
+	var _submitNewUserForm = function (event) {
 		event.preventDefault();
+		if (OC.PasswordConfirmation.requiresPasswordConfirmation()) {
+			OC.PasswordConfirmation.requirePasswordConfirmation(function() {
+				_submitNewUserForm(event);
+			});
+			return;
+		}
+
 		var username = $('#newusername').val();
 		var password = $('#newuserpassword').val();
 		var email = $('#newemail').val();
@@ -866,7 +955,8 @@ $(document).ready(function () {
 					$('#newuser').get(0).reset();
 				});
 		});
-	});
+	};
+	$('#newuser').submit(_submitNewUserForm);
 
 	if ($('#CheckboxStorageLocation').is(':checked')) {
 		$("#userlist .storageLocation").show();
@@ -874,11 +964,17 @@ $(document).ready(function () {
 	// Option to display/hide the "Storage location" column
 	$('#CheckboxStorageLocation').click(function() {
 		if ($('#CheckboxStorageLocation').is(':checked')) {
-			$("#userlist .storageLocation").show();
-			OCP.AppConfig.setValue('core', 'umgmt_show_storage_location', 'true');
+			OCP.AppConfig.setValue('core', 'umgmt_show_storage_location', 'true', {
+				success: function () {
+					$("#userlist .storageLocation").show();
+				}
+			});
 		} else {
-			$("#userlist .storageLocation").hide();
-			OCP.AppConfig.setValue('core', 'umgmt_show_storage_location', 'false');
+			OCP.AppConfig.setValue('core', 'umgmt_show_storage_location', 'false', {
+				success: function () {
+					$("#userlist .storageLocation").hide();
+				}
+			});
 		}
 	});
 
diff --git a/settings/templates/personal.php b/settings/templates/personal.php
index 69d3660477d..8f34d7b87b8 100644
--- a/settings/templates/personal.php
+++ b/settings/templates/personal.php
@@ -65,7 +65,7 @@ if($_['displayNameChangeSupported']) {
 	<h2>
 		<label for="displayName"><?php echo $l->t('Full name');?></label>
 	</h2>
-	<input type="text" id="displayName" name="displayName"
+	<input type="text" id="displayName" name="displayName" class="password-confirm-required"
 		value="<?php p($_['displayName'])?>"
 		autocomplete="on" autocapitalize="off" autocorrect="off" />
     <span class="msg"></span>
@@ -91,6 +91,7 @@ if($_['displayNameChangeSupported']) {
 	</h2>
 	<input type="email" name="email" id="email" value="<?php p($_['email']); ?>"
 		placeholder="<?php p($l->t('Your email address'));?>"
+		class="password-confirm-required"
 		autocomplete="on" autocapitalize="off" autocorrect="off" />
 	<span class="msg"></span><br />
 	<em><?php p($l->t('For password recovery and notifications'));?></em>