diff --git a/bwreg-webapp/src/main/java/edu/kit/scc/webreg/bean/UnlinkAndDeleteAccountBean.java b/bwreg-webapp/src/main/java/edu/kit/scc/webreg/bean/UnlinkAndDeleteAccountBean.java index ca8a347416269eec0a96894e587ed70e01a211ff..5d9fc4d4ba4afccac3977aa7d765a9713219381d 100644 --- a/bwreg-webapp/src/main/java/edu/kit/scc/webreg/bean/UnlinkAndDeleteAccountBean.java +++ b/bwreg-webapp/src/main/java/edu/kit/scc/webreg/bean/UnlinkAndDeleteAccountBean.java @@ -82,6 +82,11 @@ public class UnlinkAndDeleteAccountBean implements Serializable { public UserEntity getUser() { if (user == null) { user = userService.fetch(id); + + if (user == null) { + throw new IllegalArgumentException("not authorized"); + } + if (! user.getIdentity().equals(getIdentity())) { throw new IllegalArgumentException("not authorized"); }