Skip to content

Commit 99bb086

Browse files
committed
List "Boxtribute God" as available usergroups only if current user is god
Previously, when logged in as a HoO (same userlevel as Boxtribute God) and in organisation 1 (same organisation_id as Boxtribute God), it was possible to select "Boxtribute God" when editing a lower-level user.
1 parent 2479fb3 commit 99bb086

1 file changed

Lines changed: 8 additions & 5 deletions

File tree

include/cms_users_edit.php

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -135,11 +135,14 @@
135135
// display admin role in the usergroup - only for user with admin roles
136136
// related to this trello card https://trello.com/c/YAF3Az4P
137137
$usergroups = db_array('
138-
SELECT ug.id AS value, ug.label
139-
FROM cms_usergroups AS ug
140-
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON (ugl.id=ug.userlevel)
141-
WHERE ug.organisation_id = :organisation_id AND (ugl.level < :userlevel OR :is_admin OR (ugl.level <= :userlevel AND 100 = :userlevel)) AND (NOT ug.deleted OR ug.deleted IS NULL)
142-
ORDER BY ug.label', ['organisation_id' => $_SESSION['organisation']['id'], 'userlevel' => $_SESSION['usergroup']['userlevel'], 'is_admin' => $_SESSION['user']['is_admin']]);
138+
SELECT ug.id AS value, ug.label
139+
FROM cms_usergroups AS ug
140+
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON (ugl.id=ug.userlevel)
141+
WHERE ug.organisation_id = :organisation_id
142+
AND (ugl.level < :userlevel OR (ugl.level <= :userlevel AND 100 = :userlevel))
143+
AND (:is_admin OR ug.label != "Boxtribute God")
144+
AND (NOT ug.deleted OR ug.deleted IS NULL)
145+
ORDER BY ug.label', ['organisation_id' => $_SESSION['organisation']['id'], 'userlevel' => $_SESSION['usergroup']['userlevel'], 'is_admin' => $_SESSION['user']['is_admin']]);
143146
addfield('select', 'Select user group', 'cms_usergroups_id', ['required' => true, 'options' => $usergroups, 'testid' => 'user_group']);
144147

145148
addfield('line');

0 commit comments

Comments
 (0)