diff options
| author | Lukas Reschke <lukas@statuscode.ch> | 2012-10-16 00:01:48 +0200 |
|---|---|---|
| committer | Lukas Reschke <lukas@statuscode.ch> | 2012-10-16 00:01:48 +0200 |
| commit | e6c9f5d9f4ea78a89892932bd0f6752d19ee2c3a (patch) | |
| tree | 751fb7464ea826546723b35d37d30ab195c494ba /settings | |
| parent | 7e2d4e2a8e91fcc1dc57c770ced1fc67123b5f27 (diff) | |
| download | nextcloud-server-e6c9f5d9f4ea78a89892932bd0f6752d19ee2c3a.tar.gz nextcloud-server-e6c9f5d9f4ea78a89892932bd0f6752d19ee2c3a.zip | |
Verify passwords for admins
Diffstat (limited to 'settings')
| -rw-r--r-- | settings/ajax/changepassword.php | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php index 5eab751b04e..d421181c3bb 100644 --- a/settings/ajax/changepassword.php +++ b/settings/ajax/changepassword.php @@ -6,7 +6,6 @@ require_once '../../lib/base.php'; // Check if we are a user OCP\JSON::callCheck(); OC_JSON::checkLoggedIn(); -OC_JSON::verifyUser(); $username = isset($_POST["username"]) ? $_POST["username"] : OC_User::getUser(); $password = $_POST["password"]; @@ -19,8 +18,13 @@ if(OC_Group::inGroup(OC_User::getUser(), 'admin')) { if(OC_SubAdmin::isUserAccessible(OC_User::getUser(), $username)) { $userstatus = 'subadmin'; } -if(OC_User::getUser() == $username && OC_User::checkPassword($username, $oldPassword)) { - $userstatus = 'user'; +if(OC_User::getUser() === $username) { + if (OC_User::checkPassword($username, $oldPassword)) + { + $userstatus = 'user'; + } else { + $userstatus = null; + } } if(is_null($userstatus)) { @@ -28,6 +32,10 @@ if(is_null($userstatus)) { exit(); } +if($userstatus === 'admin' || $userstatus === 'subadmin') { + OC_JSON::verifyUser(); +} + // Return Success story if( OC_User::setPassword( $username, $password )) { OC_JSON::success(array("data" => array( "username" => $username ))); |