add: prevent supporters from modifying their own accounts via support

[gigi.git] / src / org / cacert / gigi / pages / admin / support / SupportUserDetailsForm.java

diff --git a/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsForm.java b/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsForm.java
index 28597ca2f8bcc9f25b9bb227f05895ae23ab66dc..d3589c8e4ad6b9a187b681400f7251a6399c7634 100644 (file)
--- a/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsForm.java
+++ b/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsForm.java
@@ -17,11 +17,8 @@ import org.cacert.gigi.output.DateSelector;
 import org.cacert.gigi.output.GroupIterator;
 import org.cacert.gigi.output.GroupSelector;
 import org.cacert.gigi.output.template.Form;
-import org.cacert.gigi.output.template.Outputable;
-import org.cacert.gigi.output.template.SprintfCommand;
 import org.cacert.gigi.output.template.Template;
-import org.cacert.gigi.output.template.TranslateCommand;
-import org.cacert.gigi.pages.PasswordResetPage;
+import org.cacert.gigi.pages.LoginPage;
 
 public class SupportUserDetailsForm extends Form {
 
@@ -44,22 +41,20 @@ public class SupportUserDetailsForm extends Form {
         if (user.getTicket() == null) {
             return false;
         }
-        if ((req.getParameter("detailupdate") != null ? 1 : 0) + (req.getParameter("grant") != null ? 1 : 0) + (req.getParameter("deny") != null ? 1 : 0) + (req.getParameter("resetPass") != null ? 1 : 0) != 1) {
+        if (user.getTargetUser() == LoginPage.getUser(req)) {
+            throw new GigiApiException("Supporter may not modify himself.");
+        }
+        if ((req.getParameter("detailupdate") != null ? 1 : 0) + (req.getParameter("addGroup") != null ? 1 : 0) + (req.getParameter("removeGroup") != null ? 1 : 0) + (req.getParameter("resetPass") != null ? 1 : 0) != 1) {
             throw new GigiApiException("More than one action requested!");
         }
-        if (req.getParameter("grant") != null || req.getParameter("deny") != null) {
-            String actionType = "granted";
+        if (req.getParameter("addGroup") != null || req.getParameter("removeGroup") != null) {
             value.update(req);
             Group toMod = value.getGroup();
-            if (req.getParameter("grant") != null) {
+            if (req.getParameter("addGroup") != null) {
                 user.grant(toMod);
             } else {
-                actionType = "revoked";
                 user.revoke(toMod);
             }
-            String subject = "Change Group Permissions";
-            Outputable message = SprintfCommand.createSimple("The group permission {0} was {1}.", toMod.getDatabaseName(), actionType);
-            user.sendSupportNotification(subject, message);
             return true;
         }
         if (req.getParameter("resetPass") != null) {
@@ -67,12 +62,7 @@ public class SupportUserDetailsForm extends Form {
             if (aword == null || aword.equals("")) {
                 throw new GigiApiException("An A-Word is required to perform a password reset.");
             }
-            Language l = Language.getInstance(user.getTargetUser().getPreferredLocale());
-            String method = l.getTranslation("A password reset was triggered. Please enter the required text sent to you by support on this page:");
-            String subject = l.getTranslation("Password reset by support.");
-            PasswordResetPage.initPasswordResetProcess(out, user.getTargetUser(), req, aword, l, method, subject);
-            Outputable message = new TranslateCommand("A password reset was triggered and an email was sent to user.");
-            user.sendSupportNotification(subject, message);
+            user.triggerPasswordReset(aword, out, req);
             return true;
         }
         dobSelector.update(req);
@@ -80,10 +70,6 @@ public class SupportUserDetailsForm extends Form {
             throw new GigiApiException("Invalid date of birth!");
         }
         user.setDob(dobSelector.getDate());
-
-        String subject = "Change Account Data";
-        Outputable message = new TranslateCommand("The account data was changed.");
-        user.sendSupportNotification(subject, message);
         return true;
     }