From 454933733574dae8fa9b255d62a89cf953f1fe44 Mon Sep 17 00:00:00 2001 From: Bond_009 Date: Wed, 15 May 2024 17:51:40 +0200 Subject: Change arguments AssertCanUpdateUser to take a user --- Jellyfin.Api/Controllers/UserController.cs | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) (limited to 'Jellyfin.Api/Controllers/UserController.cs') diff --git a/Jellyfin.Api/Controllers/UserController.cs b/Jellyfin.Api/Controllers/UserController.cs index c3923a2ad..2df79c80c 100644 --- a/Jellyfin.Api/Controllers/UserController.cs +++ b/Jellyfin.Api/Controllers/UserController.cs @@ -274,16 +274,15 @@ public class UserController : BaseJellyfinApiController [FromBody, Required] UpdateUserPassword request) { var requestUserId = userId ?? User.GetUserId(); - if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, requestUserId, true)) + var user = _userManager.GetUserById(requestUserId); + if (user is null) { - return StatusCode(StatusCodes.Status403Forbidden, "User is not allowed to update the password."); + return NotFound(); } - var user = _userManager.GetUserById(requestUserId); - - if (user is null) + if (!RequestHelpers.AssertCanUpdateUser(User, user, true)) { - return NotFound("User not found"); + return StatusCode(StatusCodes.Status403Forbidden, "User is not allowed to update the password."); } if (request.ResetPassword) @@ -386,7 +385,7 @@ public class UserController : BaseJellyfinApiController return NotFound(); } - if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, requestUserId, true)) + if (!RequestHelpers.AssertCanUpdateUser(User, user, true)) { return StatusCode(StatusCodes.Status403Forbidden, "User update not allowed."); } @@ -396,7 +395,7 @@ public class UserController : BaseJellyfinApiController await _userManager.RenameUser(user, updateUser.Name).ConfigureAwait(false); } - await _userManager.UpdateConfigurationAsync(user.Id, updateUser.Configuration).ConfigureAwait(false); + await _userManager.UpdateConfigurationAsync(requestUserId, updateUser.Configuration).ConfigureAwait(false); return NoContent(); } @@ -495,7 +494,13 @@ public class UserController : BaseJellyfinApiController [FromBody, Required] UserConfiguration userConfig) { var requestUserId = userId ?? User.GetUserId(); - if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, requestUserId, true)) + var user = _userManager.GetUserById(requestUserId); + if (user is null) + { + return NotFound(); + } + + if (!RequestHelpers.AssertCanUpdateUser(User, user, true)) { return StatusCode(StatusCodes.Status403Forbidden, "User configuration update not allowed"); } -- cgit v1.2.3