oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admin cannot be removed from admin group. An admin cannot remove themself from the Admin group. Fixes #11481.

Browse source
This commit is contained in:
Colin Kuskie 2010-03-22 15:56:39 -07:00
parent f5fd970c94
commit 7b8f9027a0
2 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/changelog/7.x.x.txt
View file

@ -10,6 +10,7 @@
- fixed #11482: Template hard-coded in deactivateAccount
- fixed #11485: RedirectAfterLoginUrl Setting should not override returnUrl and redirectAfterLogin scratch
- fixed #11466: Can't delete attached file in CS
- fixed #11481: Problem assignment group Admin to an User
7.9.0
- added #11383: AJAX username checks at registration (Luke Robinson / Orchard Solutions)

6
lib/WebGUI/Operation/User.pm
View file

@ -720,9 +720,9 @@ sub www_editUser {
my @include;
foreach my $group (@exclude) {
unless (
$group eq "1" || $group eq "2" || $group eq "7" # can't remove user from magic groups
|| ($session->user->userId eq $u->userId && $group eq 3) # cannot remove self from admin
|| ($u->isAdmin && $group eq "3") # admin user cannot be remove from admin
$group eq "1" || $group eq "2" || $group eq "7" # can't remove user from magic groups
|| ($session->user->userId eq $uid && $group eq 3) # cannot remove self from admin
|| ($uid eq '3' && $group eq "3") # user Admin cannot be removed from admin group
) {
push(@include,$group);
}