From 5b6183319cacb288b182a09c167fd1e3c79ccd23 Mon Sep 17 00:00:00 2001
From: Robert von Burg <eitch@eitchnet.ch>
Date: Thu, 29 Mar 2018 16:56:24 +0200
Subject: [PATCH] [Fix] don't persist set password if don't have privilege

---
 .../privilege/users/PrivilegeSetUserPasswordService.java | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/li.strolch.service/src/main/java/li/strolch/service/privilege/users/PrivilegeSetUserPasswordService.java b/li.strolch.service/src/main/java/li/strolch/service/privilege/users/PrivilegeSetUserPasswordService.java
index 747be6cf0..559e30b39 100644
--- a/li.strolch.service/src/main/java/li/strolch/service/privilege/users/PrivilegeSetUserPasswordService.java
+++ b/li.strolch.service/src/main/java/li/strolch/service/privilege/users/PrivilegeSetUserPasswordService.java
@@ -46,9 +46,14 @@ public class PrivilegeSetUserPasswordService extends AbstractService<PrivilegeSe
 
 		li.strolch.runtime.privilege.PrivilegeHandler strolchPrivilegeHandler = getContainer().getPrivilegeHandler();
 		PrivilegeHandler privilegeHandler = strolchPrivilegeHandler.getPrivilegeHandler();
-
 		privilegeHandler.setUserPassword(getCertificate(), arg.username, arg.password);
-		privilegeHandler.persist(getCertificate());
+
+		// only persist if not setting own password
+		if (!getCertificate().getUsername().equals(arg.username) && getPrivilegeContext().getPrivilegeNames()
+				.contains(PrivilegeHandler.PRIVILEGE_ACTION_PERSIST)) {
+
+			privilegeHandler.persist(getCertificate());
+		}
 
 		try (StrolchTransaction tx = openArgOrUserTx(arg, PrivilegeHandler.PRIVILEGE_SET_USER_PASSWORD)) {
 			tx.setSuppressAudits(true);