Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 08:36:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

refactor: change pwd change logic

Browse Source 
add one more test
This commit is contained in:
Barış Soner Uşaklı
2020-08-12 22:09:22 -04:00
parent bb8f7c74be
commit 846b7d2430
2 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/user/profile.js
View File

@@ -278,24 +278,18 @@ module.exports = function (User) {
if (meta.config['password:disableEdit'] && !isAdmin) {
throw new Error('[[error:no-privileges]]');
}
let isAdminOrPasswordMatch = false;
const isSelf = parseInt(uid, 10) === parseInt(data.uid, 10);
if (!isAdmin && !isSelf) {
throw new Error('[[user:change_password_error_privileges]]');
}
if (
(isAdmin && !isSelf) || // Admins ok
(!hasPassword && isSelf) // Initial password set ok
) {
isAdminOrPasswordMatch = true;
} else {
isAdminOrPasswordMatch = await User.isPasswordCorrect(data.uid, data.currentPassword, data.ip);
}
if (!isAdminOrPasswordMatch) {
throw new Error('[[user:change_password_error_wrong_current]]');
if (isSelf && hasPassword) {
const correct = await User.isPasswordCorrect(data.uid, data.currentPassword, data.ip);
if (!correct) {
throw new Error('[[user:change_password_error_wrong_current]]');
}
}
const hashedPassword = await User.hashPassword(data.newPassword);

13
test/user.js
View File

@@ -860,6 +860,19 @@ describe('User', function () {
assert(correct);
});
it('should not let admin change their password if current password is incorrect', async function () {
const adminUid = await User.create({ username: 'adminforgotpwd', password: 'admin1234' });
await groups.join('administrators', adminUid);
let err;
try {
await socketUser.changePassword({ uid: adminUid }, { uid: adminUid, newPassword: '654321', currentPassword: 'wrongpwd' });
} catch (_err) {
err = _err;
}
assert.equal(err.message, '[[user:change_password_error_wrong_current]]');
});
it('should change username', function (done) {
socketUser.changeUsernameEmail({ uid: uid }, { uid: uid, username: 'updatedAgain', password: '123456' }, function (err) {
assert.ifError(err);