diff options
Diffstat (limited to 'Jellyfin.Api/Controllers/UserController.cs')
| -rw-r--r-- | Jellyfin.Api/Controllers/UserController.cs | 24 |
1 files changed, 14 insertions, 10 deletions
diff --git a/Jellyfin.Api/Controllers/UserController.cs b/Jellyfin.Api/Controllers/UserController.cs index c3923a2ad..d7886d247 100644 --- a/Jellyfin.Api/Controllers/UserController.cs +++ b/Jellyfin.Api/Controllers/UserController.cs @@ -274,16 +274,15 @@ public class UserController : BaseJellyfinApiController [FromBody, Required] UpdateUserPassword request) { var requestUserId = userId ?? User.GetUserId(); - if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, requestUserId, true)) + var user = _userManager.GetUserById(requestUserId); + if (user is null) { - return StatusCode(StatusCodes.Status403Forbidden, "User is not allowed to update the password."); + return NotFound(); } - var user = _userManager.GetUserById(requestUserId); - - if (user is null) + if (!RequestHelpers.AssertCanUpdateUser(User, user, true)) { - return NotFound("User not found"); + return StatusCode(StatusCodes.Status403Forbidden, "User is not allowed to update the password."); } if (request.ResetPassword) @@ -297,7 +296,6 @@ public class UserController : BaseJellyfinApiController var success = await _userManager.AuthenticateUser( user.Username, request.CurrentPw ?? string.Empty, - request.CurrentPw ?? string.Empty, HttpContext.GetNormalizedRemoteIP().ToString(), false).ConfigureAwait(false); @@ -386,7 +384,7 @@ public class UserController : BaseJellyfinApiController return NotFound(); } - if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, requestUserId, true)) + if (!RequestHelpers.AssertCanUpdateUser(User, user, true)) { return StatusCode(StatusCodes.Status403Forbidden, "User update not allowed."); } @@ -396,7 +394,7 @@ public class UserController : BaseJellyfinApiController await _userManager.RenameUser(user, updateUser.Name).ConfigureAwait(false); } - await _userManager.UpdateConfigurationAsync(user.Id, updateUser.Configuration).ConfigureAwait(false); + await _userManager.UpdateConfigurationAsync(requestUserId, updateUser.Configuration).ConfigureAwait(false); return NoContent(); } @@ -495,7 +493,13 @@ public class UserController : BaseJellyfinApiController [FromBody, Required] UserConfiguration userConfig) { var requestUserId = userId ?? User.GetUserId(); - if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, requestUserId, true)) + var user = _userManager.GetUserById(requestUserId); + if (user is null) + { + return NotFound(); + } + + if (!RequestHelpers.AssertCanUpdateUser(User, user, true)) { return StatusCode(StatusCodes.Status403Forbidden, "User configuration update not allowed"); } |