be0133b0d4
This addresses an issue where someone can “takeover” an account with only a User’s email and a User’s previous ticket number. Once they get access to a User’s ticket they can go to the Ticket Owner’s profile and change the email to whatever they’d like. This adds a check on the profile to see if the User is a Guest User. If they are a Guest then it kicks them back to the ticket view. If they are the actual User it will let them view the profile.
45 lines
1.2 KiB
PHP
45 lines
1.2 KiB
PHP
<?php
|
|
/*********************************************************************
|
|
profile.php
|
|
|
|
Manage client profile. This will allow a logged-in user to manage
|
|
his/her own public (non-internal) information
|
|
|
|
Peter Rotich <peter@osticket.com>
|
|
Jared Hancock <jared@osticket.com>
|
|
Copyright (c) 2006-2013 osTicket
|
|
http://www.osticket.com
|
|
|
|
Released under the GNU General Public License WITHOUT ANY WARRANTY.
|
|
See LICENSE.TXT for details.
|
|
|
|
vim: expandtab sw=4 ts=4 sts=4:
|
|
$Id: $
|
|
**********************************************************************/
|
|
require 'secure.inc.php';
|
|
|
|
require_once 'class.user.php';
|
|
|
|
// Check if User is Guest. If so, redirect them back to ticket page to
|
|
// prevent Account Takeover.
|
|
if ($thisclient->isGuest())
|
|
Http::redirect('tickets.php');
|
|
|
|
$user = User::lookup($thisclient->getId());
|
|
|
|
if ($user && $_POST) {
|
|
$errors = array();
|
|
if ($acct = $thisclient->getAccount()) {
|
|
$acct->update($_POST, $errors);
|
|
}
|
|
if (!$errors && $user->updateInfo($_POST, $errors))
|
|
Http::redirect('tickets.php');
|
|
}
|
|
|
|
$inc = 'profile.inc.php';
|
|
|
|
include(CLIENTINC_DIR.'header.inc.php');
|
|
include(CLIENTINC_DIR.$inc);
|
|
include(CLIENTINC_DIR.'footer.inc.php');
|
|
|