String newPasswordConfirm,
List<Modification> changes)
throws RepositoryException {
if ("anonymous".equals(name)) {
throw new RepositoryException(
"Can not change the password of the anonymous user.");
}
User user;
UserManager userManager = AccessControlUtil.getUserManager(jcrSession);
Authorizable authorizable = userManager.getAuthorizable(name);
if (authorizable instanceof User) {
user = (User)authorizable;
} else {
throw new ResourceNotFoundException(
"User to update could not be determined");
}
//SLING-2069: if the current user is an administrator, then a missing oldPwd is ok,
// otherwise the oldPwd must be supplied.
boolean administrator = false;
// check that the submitted parameter values have valid values.
if (oldPassword == null || oldPassword.length() == 0) {
try {
UserManager um = AccessControlUtil.getUserManager(jcrSession);
User currentUser = (User) um.getAuthorizable(jcrSession.getUserID());
administrator = currentUser.isAdmin();
if (!administrator) {
//check if the user is a member of the 'User administrator' group
Authorizable userAdmin = um.getAuthorizable(this.userAdminGroupName);
if (userAdmin instanceof Group) {
boolean isMember = ((Group)userAdmin).isMember(currentUser);
if (isMember) {
administrator = true;
}
}
}
} catch ( Exception ex ) {
log.warn("Failed to determine if the user is an admin, assuming not. Cause: "+ex.getMessage());
administrator = false;
}
if (!administrator) {
throw new RepositoryException("Old Password was not submitted");
}
}
if (newPassword == null || newPassword.length() == 0) {
throw new RepositoryException("New Password was not submitted");
}
if (!newPassword.equals(newPasswordConfirm)) {
throw new RepositoryException(
"New Password does not match the confirmation password");
}
if (oldPassword != null && oldPassword.length() > 0) {
// verify old password
checkPassword(authorizable, oldPassword);
}
try {
user.changePassword(newPassword);
final String passwordPath = AuthorizableResourceProvider.SYSTEM_USER_MANAGER_USER_PREFIX + user.getID() + "/rep:password";
changes.add(Modification.onModified(passwordPath));
} catch (RepositoryException re) {
throw new RepositoryException("Failed to change user password.", re);
}
return user;
}