#2634 API: problem with switching to another profile, fixed by forcing user to switch to own profile, upon receiving token

modules/boonex/oauth2/classes/BxOAuthAPI.php

@@ -78,6 +78,13 @@ class BxOAuthAPI extends BxDol
             return;
         }
 
+        // get current account's profile (it maybe different if user switched to another profile)
+        $oAccount = $oProfile->getAccountObject();
+        if (!($oProfile = BxDolProfile::getInstanceByAccount($oAccount->id()))) {
+            $this->errorOutput('404', 'not_found', 'Profile was not found');
+            return;
+        }
+
         $aClient = $this->_oDb->getClientsBy(array('type' => 'client_id', 'client_id' => $aToken['client_id']));
 
         $aProfile = $this->_prepareProfileArray($oProfile, false);

modules/boonex/oauth2/classes/BxOAuthModule.php

@@ -32,6 +32,16 @@ class BxOAuthUserCredentialsStorage extends OAuth2\Storage\Pdo implements OAuth2
         if (!($oProfile = BxDolProfile::getInstanceByAccount($oAccount->id())))
             return false;
 
+        // don't allow login under another profile
+        if ($oProfile->getAccountId() != $oAccount->id()) {
+            // force switch to own profile
+            if ($oAccount->updateProfileContextAuto())
+                $oProfile = BxDolProfile::getInstanceByAccount($oAccount->id(), true);
+        }
+
+        if (!$oProfile)
+            return false;
+
         return array('user_id' => $oProfile->id());
     }