external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Verify current password against logged in user

Browse source 
When changing the password of an account, instead of asking for the old
password of the account, ask for the password of the currently logged in
user. This allows privileged users to edit other accounts without
knowing their passwords.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
This commit is contained in:
Lukas Fleischer 2020-01-30 12:39:52 +01:00
parent f090896fa1
commit 7aa420d24d
2 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
web/lib/acctfuncs.inc.php
View file

@ -134,10 +134,9 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$PO="",$P="
$dbh = DB::connect();
if(isset($_COOKIE['AURSID'])) {
$editor_user = uid_from_sid($_COOKIE['AURSID']);
}
else {
$editor_user = null;
$uid_session = uid_from_sid($_COOKIE['AURSID']);
} else {
$uid_session = null;
}
if (empty($E) || empty($U)) {
@ -169,7 +168,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$PO="",$P="
if (!$error && $P && $P != $C) {
$error = __("Password fields do not match.");
}
if (!$error && $P && check_passwd($UID, $PO) != 1) {
if (!$error && $P && check_passwd($uid_session, $PO) != 1) {
$error = __("The old password is invalid.");
}
if (!$error && $P != '' && !good_passwd($P)) {

4
web/template/account_edit_form.php
View file

@ -140,9 +140,9 @@
<?php if ($A == "UpdateAccount"): ?>
<fieldset>
<legend><?= __("If you want to change your password, enter your current passport, your new password and confirm the new password by entering it again.") ?></legend>
<legend><?= __("If you want to change the password, enter your current passport, the new password and confirm the new password by entering it again.") ?></legend>
<p>
<label for="id_passwd_old"><?= __("Old password") ?>:</label>
<label for="id_passwd_old"><?= __("Your current password") ?>:</label>
<input type="password" size="30" name="PO" id="id_passwd_old" value="<?= $PO ?>" />
</p>