allow a user whos not a user administrator update their own password details.2

mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java

@@ -27,6 +27,8 @@ import org.mifosng.platform.api.data.OfficeLookup;
 import org.mifosng.platform.api.infrastructure.ApiDataConversionService;
 import org.mifosng.platform.api.infrastructure.ApiParameterHelper;
 import org.mifosng.platform.organisation.service.OfficeReadPlatformService;
+import org.mifosng.platform.security.PlatformSecurityContext;
+import org.mifosng.platform.user.domain.AppUser;
 import org.mifosng.platform.user.service.AppUserReadPlatformService;
 import org.mifosng.platform.user.service.AppUserWritePlatformService;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -50,6 +52,9 @@ public class UsersApiResource {
 	@Autowired
 	private ApiDataConversionService apiDataConversionService;
 	
+	@Autowired
+	private PlatformSecurityContext context;
+	
 	@GET
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
@@ -145,7 +150,13 @@ public class UsersApiResource {
 
 		UserCommand command = this.apiDataConversionService.convertJsonToUserCommand(userId, jsonRequestBody);
 
-		this.appUserWritePlatformService.updateUser(command);
+		AppUser loggedInUser = context.authenticatedUser();
+		
+		if (loggedInUser.hasIdOf(userId)) {
+			this.appUserWritePlatformService.updateUsersOwnAccountDetails(command);
+		} else {
+			this.appUserWritePlatformService.updateUser(command);
+		}
 
 		return Response.ok().entity(new EntityIdentifier(userId)).build();
 	}

mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java

@@ -272,4 +272,8 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements P
 
 		return match;
 	}
+
+	public boolean hasIdOf(final Long userId) {
+		return getId().equals(userId);
+	}
 }

mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java

@@ -13,4 +13,7 @@ public interface AppUserWritePlatformService {
 	
 	@PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER_ROLE')")
 	void deleteUser(final Long userId);
+
+	// we dont put any permissions on this e.g. a user with no admin rights can change their own details (email, username, password etc).
+	void updateUsersOwnAccountDetails(UserCommand command);
 }

mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformServiceJpaRepositoryImpl.java

@@ -145,6 +145,12 @@ public class AppUserWritePlatformServiceJpaRepositoryImpl implements AppUserWrit
 		}
 	}
 	
+	@Transactional
+	@Override
+	public void updateUsersOwnAccountDetails(final UserCommand command) {
+		updateUser(command);
+	}
+	
 	private Set<Role> assembleSetOfRoles(final UserCommand command) {
 		
 		final Set<Role> allRoles = new HashSet<Role>();