Commit 079fde7e authored by Karamel's avatar Karamel
Browse files

Allow to set a password to a new user.

parent 02ea4d13
......@@ -42,8 +42,29 @@ class UserAPI extends APIHelper implements API
return null;
}
// TODO: add security to prevent updating password with write
public function write($data) {
$this->supportOrDie($data);
$arrayArgs = is_array($data);
$data = ($arrayArgs) ? $data : array($data);
foreach ($data as $user) {
if ($user->getId() == null) {
// Allow to set password for a new user
$hash = $user->getPassword();
if (substr($hash, 0, 5) != 'sha1:') {
$hash = sprintf('sha1:%s', sha1($hash));
}
$user->setPassword($hash);
} else {
// Prevent editing the password
// TODO: do not edit
}
}
if ($arrayArgs) {
return parent::write($data);
} else {
return parent::write($data[0]);
}
}
/** Update user's password. Null and empty string are considered
* as no password.
......@@ -62,6 +83,7 @@ class UserAPI extends APIHelper implements API
if ($newPassword === null || $newPassword == '') {
$user->setPassword(null);
} else {
// Pasteque desktop to-be-deprecated special values
if (substr($newPassword, 0, 6) == 'empty:') {
$newPassword = '';
} else if (substr($newPassword, 0, 6) == 'plain:') {
......
......@@ -102,11 +102,8 @@ class UserAPITest extends TestCase
$this->dao->write($user);
$this->dao->commit();
$this->api->updatePassword($user, '', 'pasteque');
$this->assertTrue($this->api->updatePassword($user, 'pasteque',
sprintf('sha1:%s', sha1('newPass'))));
$read = $this->dao->readSnapshot(User::class, $user->getId());
$this->assertTrue($read->authenticate('newPass'));
$this->assertFalse($read->authenticate('pasteque'));
$this->assertEquals(sprintf('sha1:%s', sha1('pasteque')), $read->getPassword());
}
/** @depends testSetPassword */
......@@ -134,4 +131,4 @@ class UserAPITest extends TestCase
$read = $this->dao->readSnapshot(User::class, $user->getId());
$this->assertTrue($read->authenticate(null));
}
}
\ No newline at end of file
}
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment