Allow re-authentication with OpenID

"Rememberme" logins aren't allowed to make changes to an account
(since cookie-stealing is too easy). Users have to re-authenticate.
Previously, it was impossible to do so without having a username and
password; this change lets you do it with OpenID, too.

1 files changed, 6 insertions, 1 deletions

diff --git a/lib/settingsaction.php b/lib/settingsaction.php
index dfe1f114b..53c807c6f 100644
--- a/lib/settingsaction.php
+++ b/lib/settingsaction.php
@@ -76,7 +76,12 @@ class SettingsAction extends Action
             // change important settings or see private info, and
             // _all_ our settings are important
             common_set_returnto($this->selfUrl());
-            common_redirect(common_local_url('login'));
+            $user = common_current_user();
+            if ($user->hasOpenID()) {
+                common_redirect(common_local_url('openidlogin'));
+            } else {
+                common_redirect(common_local_url('login'));
+            }
         } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             $this->handlePost();
         } else {