diff options
Diffstat (limited to 'settings/ajax/changepassword.php')
| -rw-r--r-- | settings/ajax/changepassword.php | 21 |
1 files changed, 15 insertions, 6 deletions
diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php index 200fdec26de..a0fe5947b6d 100644 --- a/settings/ajax/changepassword.php +++ b/settings/ajax/changepassword.php @@ -1,15 +1,13 @@ <?php +// Check if we are a user OCP\JSON::callCheck(); +OC_JSON::checkLoggedIn(); $username = isset($_POST["username"]) ? $_POST["username"] : OC_User::getUser(); $password = $_POST["password"]; $oldPassword=isset($_POST["oldpassword"])?$_POST["oldpassword"]:''; -// Check if we are a user -OC_JSON::checkLoggedIn(); -OCP\JSON::callCheck(); - $userstatus = null; if(OC_Group::inGroup(OC_User::getUser(), 'admin')) { $userstatus = 'admin'; @@ -17,8 +15,15 @@ if(OC_Group::inGroup(OC_User::getUser(), 'admin')) { if(OC_SubAdmin::isUserAccessible(OC_User::getUser(), $username)) { $userstatus = 'subadmin'; } -if(OC_User::getUser() == $username && OC_User::checkPassword($username, $oldPassword)) { - $userstatus = 'user'; +if(OC_User::getUser() === $username) { + if (OC_User::checkPassword($username, $oldPassword)) + { + $userstatus = 'user'; + } else { + if (!OC_Util::isUserVerified()) { + $userstatus = null; + } + } } if(is_null($userstatus)) { @@ -26,6 +31,10 @@ if(is_null($userstatus)) { exit(); } +if($userstatus === 'admin' || $userstatus === 'subadmin') { + OC_JSON::verifyUser(); +} + // Return Success story if( OC_User::setPassword( $username, $password )) { OC_JSON::success(array("data" => array( "username" => $username ))); |