From b73b488cc91803d2236a9f1ff7ac7d78b6b1b1fa Mon Sep 17 00:00:00 2001 From: Sujith H Date: Mon, 10 Jul 2017 14:10:15 +0530 Subject: [PATCH] [Stable10] Fix for subadmins edit email address of its users The issue was caused because annotation for non admin users to setEmailAddress method was missing. And along with that checks are added so that only admin and subadmin users can edit/set the email address of its users. A subadmin user cannot set/edit the email address which it has not access to. Signed-off-by: Sujith H --- settings/Controller/UsersController.php | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/settings/Controller/UsersController.php b/settings/Controller/UsersController.php index b2f98e66fc1f..ef07f031b882 100644 --- a/settings/Controller/UsersController.php +++ b/settings/Controller/UsersController.php @@ -35,6 +35,7 @@ use OCP\App\IAppManager; use OCP\AppFramework\Controller; use OCP\AppFramework\Http\DataResponse; +use OCP\AppFramework\Http\JSONResponse; use OCP\AppFramework\Http\RedirectResponse; use OCP\AppFramework\Http\TemplateResponse; use OCP\AppFramework\Utility\ITimeFactory; @@ -789,15 +790,25 @@ public function sendEmail($userId, $mailAddress) { } /** + * @NoAdminRequired + * * @param string $id * @param string $mailAddress */ public function setEmailAddress($id, $mailAddress) { $user = $this->userManager->get($id); - - $user->setEMailAddress($mailAddress); - if ($this->config->getUserValue($id, 'owncloud', 'changeMail') !== '') { - $this->config->deleteUserValue($id, 'owncloud', 'changeMail'); + if($this->isAdmin || + ($this->groupManager->getSubAdmin()->isSubAdmin($this->userSession->getUser()) && + $this->groupManager->getSubAdmin()->isUserAccessible($this->userSession->getUser(), $user))) { + $user->setEMailAddress($mailAddress); + if ($this->config->getUserValue($id, 'owncloud', 'changeMail') !== '') { + $this->config->deleteUserValue($id, 'owncloud', 'changeMail'); + } + } else { + return new JSONResponse([ + 'error' => 'cannotSetEmailAddress', + 'message' => 'Cannot set email address for user' + ], HTTP::STATUS_NOT_FOUND); } }