From c2e853db41a3329bf4e4c603721cd62b4db4db85 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 4 Jun 2016 18:37:41 +0200 Subject: [PATCH] FIX A non admin user should not be able to set/unset a user as admin even if he has right to manage permission --- htdocs/user/card.php | 2 +- htdocs/user/class/user.class.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/user/card.php b/htdocs/user/card.php index acfe1c85cd7..72074c25a07 100644 --- a/htdocs/user/card.php +++ b/htdocs/user/card.php @@ -333,7 +333,7 @@ if (empty($reshook)) { $object->gender = GETPOST("gender", 'alpha'); $object->pass = GETPOST("password"); $object->api_key = (GETPOST("api_key", 'alpha')) ? GETPOST("api_key", 'alpha') : $object->api_key; - $object->admin = empty($user->admin) ? 0 : GETPOST("admin"); // A user can only be set admin by an admin + if (! empty($user->admin)) $object->admin = GETPOST("admin"); // admin flag can only be set/unset by an admin user. A test is also done later when forging sql request $object->address = GETPOST('address', 'alpha'); $object->zip = GETPOST('zipcode', 'alpha'); $object->town = GETPOST('town', 'alpha'); diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php index 51945677694..6a19be4da1e 100644 --- a/htdocs/user/class/user.class.php +++ b/htdocs/user/class/user.class.php @@ -1285,7 +1285,7 @@ class User extends CommonObject $sql.= ", login = '".$this->db->escape($this->login)."'"; $sql.= ", api_key = ".($this->api_key ? "'".$this->db->escape($this->api_key)."'" : "null"); $sql.= ", gender = ".($this->gender != -1 ? "'".$this->db->escape($this->gender)."'" : "null"); // 'man' or 'woman' - $sql.= ", admin = ".$this->admin; + if (! empty($user->admin)) $sql.= ", admin = ".$this->admin; // admin flag can be set/unset only by an admin user $sql.= ", address = '".$this->db->escape($this->address)."'"; $sql.= ", zip = '".$this->db->escape($this->zip)."'"; $sql.= ", town = '".$this->db->escape($this->town)."'";