Add password changing checks

Don't allow passwords to be changed if it's forbidden by the auth
provider.

diff --git a/src/core/authenticator.h b/src/core/authenticator.h
index e0d4370..30f469e 100644 (file)
--- a/src/core/authenticator.h
+++ b/src/core/authenticator.h
@@ -61,6 +61,9 @@ public slots:
     //! Returns a list of properties required to use the authenticator backend
     virtual QStringList setupKeys() const = 0;
 
     //! Returns a list of properties required to use the authenticator backend
     virtual QStringList setupKeys() const = 0;
 

+    //! Checks if the authenticator allows manual password changes from inside quassel.
+    virtual bool canChangePassword() const = 0;
+

     //! Returns a map where the keys are are properties to use the authenticator backend
     /*  the values are QVariants with default values */
     virtual QVariantMap setupDefaults() const = 0;
     //! Returns a map where the keys are are properties to use the authenticator backend
     /*  the values are QVariants with default values */
     virtual QVariantMap setupDefaults() const = 0;

diff --git a/src/core/core.cpp b/src/core/core.cpp
index 04dd3bb..a9e1b8f 100644 (file)
--- a/src/core/core.cpp
+++ b/src/core/core.cpp
@@ -933,6 +933,12 @@ bool Core::changeUserPass(const QString &username)
         return false;
     }
 
         return false;
     }
 

+    if (!canChangeUserPassword(userId))
+    {
+        out << "User " << username << " is configured through an auth provider that has forbidden manual password changing." << endl;
+        return false;
+    }
+    

     out << "Change password for user: " << username << endl;
 
     disableStdInEcho();
     out << "Change password for user: " << username << endl;
 
     disableStdInEcho();


@@ -971,9 +977,29 @@ bool Core::changeUserPassword(UserId userId, const QString &password)
     if (!isConfigured() || !userId.isValid())
         return false;
 
     if (!isConfigured() || !userId.isValid())
         return false;
 

+    if (!canChangeUserPassword(userId))
+        return false;
+

     return instance()->_storage->updateUser(userId, password);
 }
 
     return instance()->_storage->updateUser(userId, password);
 }
 

+// XXX: this code isn't currently 100% optimal because the core
+// doesn't know it can have multiple auth providers configured (there aren't
+// multiple auth providers at the moment anyway) and we have hardcoded the
+// Database provider to be always allowed.
+bool Core::canChangeUserPassword(UserId userId)
+{
+    QString authProvider = instance()->_storage->getUserAuthenticator(userId);
+    if (authProvider != "Database")
+    {
+        if (authProvider != instance()->_authenticator->displayName()) {
+            return false;
+        } else if (instance()->_authenticator->canChangePassword()) {
+            return false;
+        }
+    }
+    return true;
+}

 
 AbstractSqlMigrationReader *Core::getMigrationReader(Storage *storage)
 {
 
 AbstractSqlMigrationReader *Core::getMigrationReader(Storage *storage)
 {

diff --git a/src/core/core.h b/src/core/core.h
index 835e787..7811b11 100644 (file)
--- a/src/core/core.h
+++ b/src/core/core.h
@@ -114,6 +114,13 @@ public:
      */
     static bool changeUserPassword(UserId userId, const QString &password);
 
      */
     static bool changeUserPassword(UserId userId, const QString &password);
 

+    //! Check if we can change a user password.
+    /**
+     * \param userID     The user's ID
+     * \return true, if we can change their password, false otherwise
+     */
+    static bool canChangeUserPassword(UserId userId);
+

     //! Store a user setting persistently
     /**
      * \param userId       The users Id
     //! Store a user setting persistently
     /**
      * \param userId       The users Id

diff --git a/src/core/ldapauthenticator.h b/src/core/ldapauthenticator.h
index cf14694..a0c8720 100644 (file)
--- a/src/core/ldapauthenticator.h
+++ b/src/core/ldapauthenticator.h
@@ -55,6 +55,8 @@ public slots:
     virtual QStringList setupKeys() const;
     virtual QVariantMap setupDefaults() const;
 
     virtual QStringList setupKeys() const;
     virtual QVariantMap setupDefaults() const;
 

+    virtual inline bool canChangePassword() const { return false; }
+

     bool setup(const QVariantMap &settings = QVariantMap());
     State init(const QVariantMap &settings = QVariantMap());
     UserId validateUser(const QString &user, const QString &password);
     bool setup(const QVariantMap &settings = QVariantMap());
     State init(const QVariantMap &settings = QVariantMap());
     UserId validateUser(const QString &user, const QString &password);

diff --git a/src/core/sqlauthenticator.h b/src/core/sqlauthenticator.h
index 51d051e..378a9d4 100644 (file)
--- a/src/core/sqlauthenticator.h
+++ b/src/core/sqlauthenticator.h
@@ -39,6 +39,8 @@ public slots:
     virtual inline QStringList setupKeys() const { return QStringList(); }
     virtual inline QVariantMap setupDefaults() const { return QVariantMap(); }
 
     virtual inline QStringList setupKeys() const { return QStringList(); }
     virtual inline QVariantMap setupDefaults() const { return QVariantMap(); }
 

+    virtual inline bool canChangePassword() const { return true; }
+

     bool setup(const QVariantMap &settings = QVariantMap());
     State init(const QVariantMap &settings = QVariantMap());
     UserId validateUser(const QString &user, const QString &password);
     bool setup(const QVariantMap &settings = QVariantMap());
     State init(const QVariantMap &settings = QVariantMap());
     UserId validateUser(const QString &user, const QString &password);