feat: fix bug in SetPassword() API (#3296)

* feat: support control whether overwrite existing data during initDataFromFile

* feat: change conf var name

* feat: change conf var name

conf/app.conf

@@ -29,6 +29,6 @@ radiusServerPort = 1812
 radiusSecret = "secret"
 quota = {"organization": -1, "user": -1, "application": -1, "provider": -1}
 logConfig = {"filename": "logs/casdoor.log", "maxdays":99999, "perm":"0770"}
-initDataFile = "./init_data.json"
 initDataNewOnly = false
-frontendBaseDir = "../casdoor"
+initDataFile = "./init_data.json"
+frontendBaseDir = "../cc_0"

controllers/user.go

@@ -494,7 +494,12 @@ func (c *ApiController) SetPassword() {
 			c.ResponseError(c.T("general:Missing parameter"))
 			return
 		}
+		if userId != c.GetSession("verifiedUserId") {
+			c.ResponseError(c.T("general:Wrong userId"))
+			return
+		}
 		c.SetSession("verifiedCode", "")
+		c.SetSession("verifiedUserId", "")
 	}
 
 	targetUser, err := object.GetUser(userId)

controllers/verification.go

@@ -533,5 +533,6 @@ func (c *ApiController) VerifyCode() {
 	}
 
 	c.SetSession("verifiedCode", authForm.Code)
+	c.SetSession("verifiedUserId", user.GetId())
 	c.ResponseOk()
 }