Téléverser les fichiers vers "workstation-setup/src"

workstation-setup/src/ProvisioningBackend.cpp

@@ -36,13 +36,12 @@ ProvisioningBackend::ProvisioningBackend(QString targetUser, QObject *parent)
     : QObject(parent)
     , m_currentUser(effectiveUserName())
     , m_targetUser(std::move(targetUser))
-    , m_authorizedUser(!m_targetUser.isEmpty() && m_currentUser == m_targetUser)
 {
     refreshState();
     appendLog(QStringLiteral("START currentUser=%1 targetUser=%2 authorized=%3 passwordDone=%4 pinDone=%5")
                   .arg(m_currentUser,
                        m_targetUser,
-                       m_authorizedUser ? QStringLiteral("yes") : QStringLiteral("no"),
+                       authorizedUser() ? QStringLiteral("yes") : QStringLiteral("no"),
                        m_passwordDone ? QStringLiteral("yes") : QStringLiteral("no"),
                        m_pinDone ? QStringLiteral("yes") : QStringLiteral("no")));
 }
@@ -65,6 +64,21 @@ QString ProvisioningBackend::effectiveUserName()
     return {};
 }
 
+
+bool ProvisioningBackend::authorizedUser() const
+{
+    if (m_targetUser.isEmpty()) {
+        return false;
+    }
+
+    const QByteArray targetName = m_targetUser.toLocal8Bit();
+    if (passwd *entry = getpwnam(targetName.constData())) {
+        return entry->pw_uid == geteuid();
+    }
+
+    return false;
+}
+
 QString ProvisioningBackend::stateDirectory() const
 {
     const QByteArray xdgState = qgetenv("XDG_STATE_HOME");
@@ -223,7 +237,7 @@ void ProvisioningBackend::changePassword(const QString &currentPassword,
                                           const QString &newPassword,
                                           const QString &confirmation)
 {
-    if (!m_authorizedUser) {
+    if (!authorizedUser()) {
         appendLog(QStringLiteral("PASSWORD refused: unauthorized user"));
         emit passwordChangeFinished(false,
             QStringLiteral("Cette opération n'est pas autorisée pour cet utilisateur."));
@@ -279,7 +293,7 @@ void ProvisioningBackend::changePin(const QString &currentPin,
                                      const QString &newPin,
                                      const QString &confirmation)
 {
-    if (!m_authorizedUser) {
+    if (!authorizedUser()) {
         appendLog(QStringLiteral("PIN refused: unauthorized user"));
         emit pinChangeFinished(false,
             QStringLiteral("Cette opération n'est pas autorisée pour cet utilisateur."));

workstation-setup/src/ProvisioningBackend.h

@@ -27,7 +27,7 @@ public:
     bool complete() const { return m_passwordDone && m_pinDone; }
     QString currentUser() const { return m_currentUser; }
     QString targetUser() const { return m_targetUser; }
-    bool authorizedUser() const { return m_authorizedUser; }
+    bool authorizedUser() const;
 
     QString stateDirectory() const;
     QString diagnosticLogPath() const;
@@ -79,7 +79,6 @@ private:
     bool m_busy = false;
     bool m_passwordDone = false;
     bool m_pinDone = false;
-    bool m_authorizedUser = false;
     bool m_helperTimedOut = false;
     QString m_currentUser;
     QString m_targetUser;