yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated to move the logic for whether the password change can occur, into the controller,

Browse Source
This commit is contained in:
Emma Garland
2021-02-26 12:42:18 +00:00
parent 8f392c252a
commit c36aaabd0e
5 changed files with 27 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/Umbraco.Web.BackOffice/Controllers/MemberController.cs
View File

@@ -471,16 +471,17 @@ namespace Umbraco.Cms.Web.BackOffice.Controllers
}
IUser currentUser = _backOfficeSecurityAccessor.BackOfficeSecurity.CurrentUser;
// if the current user has access to reset/manually change the password
if (currentUser.HasSectionAccess(Constants.Applications.Members) == false)
{
return new ValidationErrorResult("The current user is not authorized");
}
var changingPasswordModel = new ChangingPasswordModel
{
Id = intId.Result,
OldPassword = contentItem.Password.OldPassword,
NewPassword = contentItem.Password.NewPassword,
CurrentUsername = currentUser.Username,
SavingUserId = foundMember.Id,
SavingUsername = foundMember.Username,
CurrentUserHasSectionAccess = currentUser.HasSectionAccess(Constants.Applications.Members)
};
};
Attempt<PasswordChangedModel> passwordChangeResult = await _passwordChanger.ChangePasswordWithIdentityAsync(changingPasswordModel, _memberManager);