Skip to content
GitLab
Menu
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
Pasteque
pasteque-server
Commits
079fde7e
Commit
079fde7e
authored
Jul 30, 2019
by
Karamel
Browse files
Allow to set a password to a new user.
parent
02ea4d13
Changes
2
Hide whitespace changes
Inline
Side-by-side
src/lib/API/UserAPI.php
View file @
079fde7e
...
...
@@ -42,8 +42,29 @@ class UserAPI extends APIHelper implements API
return
null
;
}
// TODO: add security to prevent updating password with write
public
function
write
(
$data
)
{
$this
->
supportOrDie
(
$data
);
$arrayArgs
=
is_array
(
$data
);
$data
=
(
$arrayArgs
)
?
$data
:
array
(
$data
);
foreach
(
$data
as
$user
)
{
if
(
$user
->
getId
()
==
null
)
{
// Allow to set password for a new user
$hash
=
$user
->
getPassword
();
if
(
substr
(
$hash
,
0
,
5
)
!=
'sha1:'
)
{
$hash
=
sprintf
(
'sha1:%s'
,
sha1
(
$hash
));
}
$user
->
setPassword
(
$hash
);
}
else
{
// Prevent editing the password
// TODO: do not edit
}
}
if
(
$arrayArgs
)
{
return
parent
::
write
(
$data
);
}
else
{
return
parent
::
write
(
$data
[
0
]);
}
}
/** Update user's password. Null and empty string are considered
* as no password.
...
...
@@ -62,6 +83,7 @@ class UserAPI extends APIHelper implements API
if
(
$newPassword
===
null
||
$newPassword
==
''
)
{
$user
->
setPassword
(
null
);
}
else
{
// Pasteque desktop to-be-deprecated special values
if
(
substr
(
$newPassword
,
0
,
6
)
==
'empty:'
)
{
$newPassword
=
''
;
}
else
if
(
substr
(
$newPassword
,
0
,
6
)
==
'plain:'
)
{
...
...
tests/API/UserAPITest.php
View file @
079fde7e
...
...
@@ -102,11 +102,8 @@ class UserAPITest extends TestCase
$this
->
dao
->
write
(
$user
);
$this
->
dao
->
commit
();
$this
->
api
->
updatePassword
(
$user
,
''
,
'pasteque'
);
$this
->
assertTrue
(
$this
->
api
->
updatePassword
(
$user
,
'pasteque'
,
sprintf
(
'sha1:%s'
,
sha1
(
'newPass'
))));
$read
=
$this
->
dao
->
readSnapshot
(
User
::
class
,
$user
->
getId
());
$this
->
assertTrue
(
$read
->
authenticate
(
'newPass'
));
$this
->
assertFalse
(
$read
->
authenticate
(
'pasteque'
));
$this
->
assertEquals
(
sprintf
(
'sha1:%s'
,
sha1
(
'pasteque'
)),
$read
->
getPassword
());
}
/** @depends testSetPassword */
...
...
@@ -134,4 +131,4 @@ class UserAPITest extends TestCase
$read
=
$this
->
dao
->
readSnapshot
(
User
::
class
,
$user
->
getId
());
$this
->
assertTrue
(
$read
->
authenticate
(
null
));
}
}
\ No newline at end of file
}
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment