Fix to users with auth key access not being able to reset their authkey

Xen0ph0n · Nov 12, 2013 · 7f6c842 · 7f6c842
1 parent 8c1d42d
commit 7f6c842
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/Controller/UsersController.php b/app/Controller/UsersController.php
@@ -407,7 +407,7 @@ public function resetauthkey($id = null) {
  }
  $this->User->read();
  if ('me' == $id ) $id = $this->Auth->user('id');
- else if (!$this->_isSiteAdmin() && !($this->_isAdmin() && $this->Auth->user('org') == $this->User->data['User']['org'])) throw new MethodNotAllowedException();
+ else if (!$this->_isSiteAdmin() && !($this->_isAdmin() && $this->Auth->user('org') == $this->User->data['User']['org']) && ($this->Auth->user('id') != $id)) throw new MethodNotAllowedException();
  $newkey = $this->User->generateAuthKey();
  $this->User->saveField('authkey', $newkey);
  $this->Session->setFlash(__('New authkey generated.', true));