From 17da13144babbdd7e86f7cef8cc0f70471506e6e Mon Sep 17 00:00:00 2001
From: Olivier <1+olivier@noreply.raspot.in>
Date: Wed, 19 Aug 2026 09:37:38 +0200
Subject: [PATCH] =?UTF-8?q?T=C3=A9l=C3=A9verser=20les=20fichiers=20vers=20?=
 =?UTF-8?q?"workstation-setup/src"?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 workstation-setup/src/ProvisioningBackend.cpp | 22 +++++++++++++++----
 workstation-setup/src/ProvisioningBackend.h   |  3 +--
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/workstation-setup/src/ProvisioningBackend.cpp b/workstation-setup/src/ProvisioningBackend.cpp
index 48e4b56..8ca84d0 100644
--- a/workstation-setup/src/ProvisioningBackend.cpp
+++ b/workstation-setup/src/ProvisioningBackend.cpp
@@ -36,13 +36,12 @@ ProvisioningBackend::ProvisioningBackend(QString targetUser, QObject *parent)
     : QObject(parent)
     , m_currentUser(effectiveUserName())
     , m_targetUser(std::move(targetUser))
-    , m_authorizedUser(!m_targetUser.isEmpty() && m_currentUser == m_targetUser)
 {
     refreshState();
     appendLog(QStringLiteral("START currentUser=%1 targetUser=%2 authorized=%3 passwordDone=%4 pinDone=%5")
                   .arg(m_currentUser,
                        m_targetUser,
-                       m_authorizedUser ? QStringLiteral("yes") : QStringLiteral("no"),
+                       authorizedUser() ? QStringLiteral("yes") : QStringLiteral("no"),
                        m_passwordDone ? QStringLiteral("yes") : QStringLiteral("no"),
                        m_pinDone ? QStringLiteral("yes") : QStringLiteral("no")));
 }
@@ -65,6 +64,21 @@ QString ProvisioningBackend::effectiveUserName()
     return {};
 }
 
+
+bool ProvisioningBackend::authorizedUser() const
+{
+    if (m_targetUser.isEmpty()) {
+        return false;
+    }
+
+    const QByteArray targetName = m_targetUser.toLocal8Bit();
+    if (passwd *entry = getpwnam(targetName.constData())) {
+        return entry->pw_uid == geteuid();
+    }
+
+    return false;
+}
+
 QString ProvisioningBackend::stateDirectory() const
 {
     const QByteArray xdgState = qgetenv("XDG_STATE_HOME");
@@ -223,7 +237,7 @@ void ProvisioningBackend::changePassword(const QString &currentPassword,
                                           const QString &newPassword,
                                           const QString &confirmation)
 {
-    if (!m_authorizedUser) {
+    if (!authorizedUser()) {
         appendLog(QStringLiteral("PASSWORD refused: unauthorized user"));
         emit passwordChangeFinished(false,
             QStringLiteral("Cette opération n'est pas autorisée pour cet utilisateur."));
@@ -279,7 +293,7 @@ void ProvisioningBackend::changePin(const QString &currentPin,
                                      const QString &newPin,
                                      const QString &confirmation)
 {
-    if (!m_authorizedUser) {
+    if (!authorizedUser()) {
         appendLog(QStringLiteral("PIN refused: unauthorized user"));
         emit pinChangeFinished(false,
             QStringLiteral("Cette opération n'est pas autorisée pour cet utilisateur."));
diff --git a/workstation-setup/src/ProvisioningBackend.h b/workstation-setup/src/ProvisioningBackend.h
index b4a5e0f..7cf0ac5 100644
--- a/workstation-setup/src/ProvisioningBackend.h
+++ b/workstation-setup/src/ProvisioningBackend.h
@@ -27,7 +27,7 @@ public:
     bool complete() const { return m_passwordDone && m_pinDone; }
     QString currentUser() const { return m_currentUser; }
     QString targetUser() const { return m_targetUser; }
-    bool authorizedUser() const { return m_authorizedUser; }
+    bool authorizedUser() const;
 
     QString stateDirectory() const;
     QString diagnosticLogPath() const;
@@ -79,7 +79,6 @@ private:
     bool m_busy = false;
     bool m_passwordDone = false;
     bool m_pinDone = false;
-    bool m_authorizedUser = false;
     bool m_helperTimedOut = false;
     QString m_currentUser;
     QString m_targetUser;