inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-08-14 17:58:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged 5.2.0 (5.2.0) to HEAD (5.2)

Browse Source 
133861 rmunteanu: REPO-1746: Merge fixes for 5.2 GA issues to 5.2.0 branch (Solved compilation issues after conflict)
      Merged 5.2.N (5.2.1) to 5.2.0 (5.2.0)
         133307 jvonka: V1 REST API - update person (password)
         - REPO-1627 - Update password for a person with empty string
         - REPO-1643 - Missing 'oldPassword' field accompanies 403 status code, but should be 400


git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@134190 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Alan Davis
2017-01-11 10:35:17 +00:00
parent 4a4ba28e80
commit 5b62bb1da2
1 changed files with 0 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
source/java/org/alfresco/rest/api/impl/PeopleImpl.java
View File

@@ -534,8 +534,6 @@ public class PeopleImpl implements People
validateUpdatePersonData(person);
boolean isAdmin = isAdminAuthority();
String currentUserId = AuthenticationUtil.getFullyAuthenticatedUser();
if (!isAdmin && !currentUserId.equalsIgnoreCase(personId))
{
@@ -667,55 +665,6 @@ public class PeopleImpl implements People
}
}
private void updatePassword(boolean isAdmin, String personIdToUpdate, Person person)
{
MutableAuthenticationService mutableAuthenticationService = (MutableAuthenticationService) authenticationService;
boolean isOldPassword = person.wasSet(Person.PROP_PERSON_OLDPASSWORD);
boolean isPassword = person.wasSet(Person.PROP_PERSON_PASSWORD);
if (isPassword || isOldPassword)
{
if (isOldPassword && ((person.getOldPassword() == null) || (person.getOldPassword().isEmpty())))
{
throw new IllegalArgumentException("'oldPassword' field cannot be empty.");
}
if (!isPassword || (person.getPassword() == null) || (person.getPassword().isEmpty()))
{
throw new IllegalArgumentException("password' field cannot be empty.");
}
char[] newPassword = person.getPassword().toCharArray();
if (!isAdmin)
{
// Non-admin users can update their own password, but must provide their current password.
if (!isOldPassword)
{
throw new IllegalArgumentException("To change password, both 'oldPassword' and 'password' fields are required.");
}
char[] oldPassword = person.getOldPassword().toCharArray();
try
{
mutableAuthenticationService.updateAuthentication(personIdToUpdate, oldPassword, newPassword);
}
catch (AuthenticationException e)
{
throw new PermissionDeniedException("Incorrect password.");
}
}
else
{
// An admin user can update without knowing the original pass - but must know their own!
// note: is it reasonable to silently ignore oldPassword if supplied ?
mutableAuthenticationService.setAuthentication(personIdToUpdate, newPassword);
}
}
}
private boolean isAdminAuthority()
{
return authorityService.hasAdminAuthority();