Require current password when using passwd to change your own password.

Add a new required parameter, current_password. In order to ask this
first I added a new parameter option, sortorder. The lower the value the
earlier it will be prompted for.

I also changed the way autofill works. It will attempt to get the default
and if it doesn't get anything will continue prompting interactively.

Since current_password is required I'm passing a magic value that
means changing someone else's password. We need to pass something
since current_password is required.

The python-ldap passwd command doesn't seem to use the old password at
all so I do a simple bind to validate it.

https://fedorahosted.org/freeipa/ticket/1808

1 files changed, 4 insertions, 2 deletions

diff --git a/ipalib/cli.py b/ipalib/cli.py
index 0a7d1a4cf..86365e7ca 100644
--- a/ipalib/cli.py
+++ b/ipalib/cli.py
@@ -1048,12 +1048,14 @@ class cli(backend.Executioner):
         for param in cmd.params():
             if (param.required and param.name not in kw) or \
                 (param.alwaysask and honor_alwaysask) or self.env.prompt_all:
+                if param.autofill:
+                    kw[param.name] = param.get_default(**kw)
+                if param.name in kw and kw[param.name] is not None:
+                    continue
                 if param.password:
                     kw[param.name] = self.Backend.textui.prompt_password(
                         param.label, param.confirm
                     )
-                elif param.autofill:
-                    kw[param.name] = param.get_default(**kw)
                 else:
                     default = param.get_default(**kw)
                     error = None