Require password for fallback email change

2021-09-09 23:01:28 +02:00
parent d3d22f0878
commit 59cbac0171
2 changed files with 43 additions and 3 deletions
@@ -64,6 +64,14 @@ async function update(req, res, next) {

    const data = _.pick(req.body, 'email', 'fallbackEmail', 'displayName');

+    // for fallbackEmail we check the password
+    if (data.fallbackEmail) {
+        if (!req.body.password || typeof req.body.password !== 'string') return next(new HttpError(400, 'password must be non empty string'));
+
+        const [verifyError] = await safe(users.verify(req.user.id, req.body.password, users.AP_WEBADMIN));
+        if (verifyError) return next(BoxError.toHttpError(verifyError));
+    }
+
    const [error] = await safe(users.update(req.user, data, auditSource.fromRequest(req)));
    if (error) return next(BoxError.toHttpError(error));