From 815d0c25895165800b675d172755c1b20242b9cc Mon Sep 17 00:00:00 2001 From: "Sekan, Tobias" Date: Wed, 23 Sep 2020 13:18:09 +0200 Subject: [PATCH 1/2] Fix that a admin can remove all his user rights --- htdocs/user/class/user.class.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php index 786af8c81d1..3b4a91b2f2f 100644 --- a/htdocs/user/class/user.class.php +++ b/htdocs/user/class/user.class.php @@ -701,6 +701,15 @@ class User extends CommonObject $sql .= " AND ".$wherefordel; } + // avoid admin can remove his own important rights + if($this->admin == 1) + { + $sql .= " AND id NOT IN (251, 252, 253, 254, 255, 256)"; // other users rights + $sql .= " AND id NOT IN (341, 342, 343, 344)"; // own rights + $sql .= " AND id NOT IN (351, 352, 353, 354)"; // groups rights + $sql .= " AND id NOT IN (358)"; // user export + } + $result = $this->db->query($sql); if ($result) { From a88c0b97a860f550941f0c28b3e6c18438160dbb Mon Sep 17 00:00:00 2001 From: stickler-ci Date: Wed, 23 Sep 2020 11:31:17 +0000 Subject: [PATCH 2/2] Fixing style errors. --- htdocs/user/class/user.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php index 3b4a91b2f2f..923102f6df5 100644 --- a/htdocs/user/class/user.class.php +++ b/htdocs/user/class/user.class.php @@ -702,7 +702,7 @@ class User extends CommonObject } // avoid admin can remove his own important rights - if($this->admin == 1) + if ($this->admin == 1) { $sql .= " AND id NOT IN (251, 252, 253, 254, 255, 256)"; // other users rights $sql .= " AND id NOT IN (341, 342, 343, 344)"; // own rights