Changeset 487

Timestamp:

10/17/2006 07:43:57 PM (19 years ago)

Author:

mdawaffe

Message:

Require change_password cap. Fixes #447

Location:

trunk

Files:

• bb-includes/capabilities.php (modified) (5 diffs)
• bb-includes/registration-functions.php (modified) (1 diff)
• bb-templates/profile-edit.php (modified) (1 diff)
• profile-edit.php (modified) (1 diff)

trunk/bb-includes/capabilities.php

@@ -57 +57 @@
                         'write_topics' => true,
                         'write_posts' => true,
+                        'change_password' => true,
                         'read' => true
                 )),
@@ -89 +90 @@
                         'write_topics' => true,
                         'write_posts' => true,
+                        'change_password' => true,
                         'read' => true
                 )),
@@ -116 +118 @@
                         'write_topics' => true,
                         'write_posts' => true,
+                        'change_password' => true,
                         'read' => true
                 )),
@@ -131 +134 @@
                         'write_topics' => true,
                         'write_posts' => true,
+                        'change_password' => true,
                         'read' => true
                 )),
@@ -137 +141 @@
                     'name' => __('Inactive'),
                     'capabilities' => array(
+                        'change_password' => true,
                         'read' => true
                 )),

trunk/bb-includes/registration-functions.php

@@ -79 +79 @@
     if ( !$user_id = $bbdb->get_var("SELECT user_id FROM $bbdb->usermeta WHERE meta_key = 'newpwdkey' AND meta_value = '$key'") )
         bb_die(__('Key not found.'));
-    if ( $user = bb_get_user( $user_id ) ) :
+    if ( $user = new BB_User( $user_id ) ) :
         if ( bb_has_broken_pass( $user->ID ) )
             bb_block_current_user();
+        if ( !$user->has_cap( 'change_password' ) )
+            bb_die( __('You are not allowed to change your password.') );
         $newpass = bb_random_pass( 6 );
         bb_update_user_password( $user->ID, $newpass );

trunk/bb-templates/profile-edit.php

@@ -75 +75 @@
 <?php endif; ?>
 
-<?php if ( $bb_current_user->ID == $user->ID ) : ?>
+<?php if ( $bb_current_user->ID == $user->ID && bb_current_user_can( 'change_password' ) ) : ?>
 <fieldset>
 <legend><?php _e('Password'); ?></legend>

trunk/profile-edit.php

@@ -96 +96 @@
         endif;
 
-        if ( !empty( $_POST['pass1'] ) && $_POST['pass1'] == $_POST['pass2'] && $bb_current_user->ID == $user->ID ) :
+        if ( bb_current_user_can( 'change_password' ) && !empty( $_POST['pass1'] ) && $_POST['pass1'] == $_POST['pass2'] && $bb_current_user->ID == $user->ID ) :
             bb_update_user_password ( $bb_current_user->ID, $_POST['pass1'] );
             bb_cookie( $bb->passcookie, md5( md5( $_POST['pass1'] ) ) ); // One week