diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java index ac87c51f6..73bd8f769 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java @@ -27,6 +27,8 @@ import org.mifosng.platform.api.data.OfficeLookup; import org.mifosng.platform.api.infrastructure.ApiDataConversionService; import org.mifosng.platform.api.infrastructure.ApiParameterHelper; import org.mifosng.platform.organisation.service.OfficeReadPlatformService; +import org.mifosng.platform.security.PlatformSecurityContext; +import org.mifosng.platform.user.domain.AppUser; import org.mifosng.platform.user.service.AppUserReadPlatformService; import org.mifosng.platform.user.service.AppUserWritePlatformService; import org.springframework.beans.factory.annotation.Autowired; @@ -50,6 +52,9 @@ public class UsersApiResource { @Autowired private ApiDataConversionService apiDataConversionService; + @Autowired + private PlatformSecurityContext context; + @GET @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) @@ -145,7 +150,13 @@ public class UsersApiResource { UserCommand command = this.apiDataConversionService.convertJsonToUserCommand(userId, jsonRequestBody); - this.appUserWritePlatformService.updateUser(command); + AppUser loggedInUser = context.authenticatedUser(); + + if (loggedInUser.hasIdOf(userId)) { + this.appUserWritePlatformService.updateUsersOwnAccountDetails(command); + } else { + this.appUserWritePlatformService.updateUser(command); + } return Response.ok().entity(new EntityIdentifier(userId)).build(); } diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java index a81ed2b5e..b7ba5a35b 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java @@ -272,4 +272,8 @@ public class AppUser extends AbstractAuditableCustom implements P return match; } + + public boolean hasIdOf(final Long userId) { + return getId().equals(userId); + } } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java index bc925110c..66e274a3f 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java @@ -13,4 +13,7 @@ public interface AppUserWritePlatformService { @PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER_ROLE')") void deleteUser(final Long userId); + + // we dont put any permissions on this e.g. a user with no admin rights can change their own details (email, username, password etc). + void updateUsersOwnAccountDetails(UserCommand command); } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformServiceJpaRepositoryImpl.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformServiceJpaRepositoryImpl.java index 80125d276..078d70166 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformServiceJpaRepositoryImpl.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformServiceJpaRepositoryImpl.java @@ -145,6 +145,12 @@ public class AppUserWritePlatformServiceJpaRepositoryImpl implements AppUserWrit } } + @Transactional + @Override + public void updateUsersOwnAccountDetails(final UserCommand command) { + updateUser(command); + } + private Set assembleSetOfRoles(final UserCommand command) { final Set allRoles = new HashSet();