local-it/vikunja-api
0
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Improved update password method to ask the current password

Browse source
This commit is contained in:
kolaente 2018-10-04 07:53:45 +02:00
parent a6d49a5e70
commit 1139eee2ad
No known key found for this signature in database
GPG key ID: F40E70337AB24C9B
2 changed files with 25 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
REST-Tests/users.http
View file

@ -8,4 +8,17 @@ Authorization: Bearer {{auth_token}}
GET http://localhost:8080/api/v1/users?s=3 GET http://localhost:8080/api/v1/users?s=3
Authorization: Bearer {{auth_token}} Authorization: Bearer {{auth_token}}
###
## Update password
POST http://localhost:8080/api/v1/user/password
Authorization: Bearer {{auth_token}}
Content-Type: application/json
{
"old_password": "1234",
"new_password": "1234"
}
### ###

16
routes/api/v1/user_update_password.go
View file

@ -8,7 +8,8 @@ import (
// UserPassword holds a user password. Used to update it. // UserPassword holds a user password. Used to update it.
type UserPassword struct { type UserPassword struct {
Password string `json:"password"` OldPassword string `json:"old_password"`
NewPassword string `json:"new_password"`
} }
// UserChangePassword is the handler to change a users password // UserChangePassword is the handler to change a users password
@ -47,14 +48,21 @@ func UserChangePassword(c echo.Context) error {
return echo.NewHTTPError(http.StatusBadRequest, "No password provided.") return echo.NewHTTPError(http.StatusBadRequest, "No password provided.")
} }
// Check the current password
if _, err = models.CheckUserCredentials(&models.UserLogin{Username:doer.Username,Password:newPW.OldPassword}); err != nil {
if models.IsErrUserDoesNotExist(err) {
return echo.NewHTTPError(http.StatusNotFound, "The user does not exist.")
}
return c.JSON(http.StatusUnauthorized, models.Message{"Wrong password."})
}
// Update the password // Update the password
err = models.UpdateUserPassword(&doer, newPW.Password) if err = models.UpdateUserPassword(&doer, newPW.NewPassword); err != nil {
if err != nil {
if models.IsErrUserDoesNotExist(err) { if models.IsErrUserDoesNotExist(err) {
return echo.NewHTTPError(http.StatusNotFound, "The user does not exist.") return echo.NewHTTPError(http.StatusNotFound, "The user does not exist.")
} }
models.Log.Error("Error updating a users password, user: %d", doer.ID) models.Log.Error("Error updating a users password, user: %d, err: %s", doer.ID, err)
return echo.NewHTTPError(http.StatusInternalServerError, "An error occurred.") return echo.NewHTTPError(http.StatusInternalServerError, "An error occurred.")
} }