mirror/php-flarum
1
0
Fork 0
mirror of https://github.com/flarum/core.git synced 2025-07-31 13:40:20 +02:00
Code Issues Releases Wiki Activity

Remove sudo mode and add password confirmation when changing email address

Browse Source 
closes #674
This commit is contained in:
Toby Zerner
2016-03-11 12:44:18 +10:30
parent dc757fae5f
commit e37c7a9b06
19 changed files with 80 additions and 477 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/Api/Controller/UpdateUserController.php
View File

@@ -10,16 +10,14 @@
namespace Flarum\Api\Controller;
use Flarum\Core\Access\AssertPermissionTrait;
use Flarum\Core\Command\EditUser;
use Flarum\Core\Exception\PermissionDeniedException;
use Illuminate\Contracts\Bus\Dispatcher;
use Psr\Http\Message\ServerRequestInterface;
use Tobscure\JsonApi\Document;
class UpdateUserController extends AbstractResourceController
{
use AssertPermissionTrait;
/**
* {@inheritdoc}
*/
@@ -52,7 +50,15 @@ class UpdateUserController extends AbstractResourceController
$actor = $request->getAttribute('actor');
$data = array_get($request->getParsedBody(), 'data', []);
$this->assertSudo($request);
// Require the user's current password if they are attempting to change
// their own email address.
if (isset($data['attributes']['email']) && $actor->id == $id) {
$password = array_get($request->getParsedBody(), 'meta.password');
if (! $actor->checkPassword($password)) {
throw new PermissionDeniedException;
}
}
return $this->bus->dispatch(
new EditUser($id, $actor, $data)