diff --git a/core/templates/verify.php b/core/templates/verify.php new file mode 100644 index 0000000000..7be0d69ed0 --- /dev/null +++ b/core/templates/verify.php @@ -0,0 +1,18 @@ +
+
+ +

+ +

+

+ + +

+ +
+
diff --git a/lib/util.php b/lib/util.php index 9a3bf16206..b92f97b037 100755 --- a/lib/util.php +++ b/lib/util.php @@ -361,6 +361,7 @@ class OC_Util { public static function checkAdminUser() { // Check if we are a user self::checkLoggedIn(); + self::verifyUser(); if( !OC_Group::inGroup( OC_User::getUser(), 'admin' )) { header( 'Location: '.OC_Helper::linkToAbsolute( '', 'index.php' )); exit(); @@ -374,6 +375,7 @@ class OC_Util { public static function checkSubAdminUser() { // Check if we are a user self::checkLoggedIn(); + self::verifyUser(); if(OC_Group::inGroup(OC_User::getUser(),'admin')) { return true; } @@ -384,6 +386,23 @@ class OC_Util { return true; } + /** + * Check if the user verified the login with his password in the last 15 minutes + * If not, the user will be shown a password verification page + */ + public static function verifyUser() { + // Check password to set session + if (OC_User::login(OC_User::getUser(), $_POST["password"] ) === true) { + $_SESSION['verifiedLogin']=time() + (15 * 60); + } + + // Check if the user verified his password in the last 15 minutes + if($_SESSION['verifiedLogin'] < time() OR !isset($_SESSION['verifiedLogin'])) { + OC_Template::printGuestPage("", "verify", array('username' => OC_User::getUser())); + exit(); + } + } + /** * Redirect to the user default page */