List current logged-in HoO user as editable row in cms_users

- make user visible (non-gray)
- only for HoO users
- enable user editing themselves (no 403 error when clicking row)

Author: pylipp

include/cms_users.php

@@ -46,13 +46,14 @@
     // Do not forget to specify :userGroupLevel and :user in the db call later
     // related to this trello card https://trello.com/c/KI47eGPI
     $cms_users_same_or_upper_level_query = '
-			SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
+			SELECT u.*, IF(u.id = :user, 1, 0) AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
 			FROM cms_users AS u
 			INNER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id 
 			INNER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
 			INNER JOIN cms_usergroups_levels AS l ON l.id = g.userlevel
-			WHERE (l.level >= :userGroupLevel AND u.id != :user)
-            AND uc.camp_id IN ('.($_SESSION['camp']['id'] ?: 0).')
+            WHERE l.level >= :userGroupLevel
+            AND (u.id != :user OR :userGroupLevel = 100)
+            AND uc.camp_id IN ('.(intval($_SESSION['camp']['id']) ?: 0).')
 			AND NOT (u.valid_lastday < CURDATE() AND UNIX_TIMESTAMP(u.valid_lastday) != 0)
 			AND UNIX_TIMESTAMP(u.deleted) = 0
             GROUP BY u.id

include/cms_users_edit.php

@@ -114,7 +114,12 @@
 		FROM cms_usergroups AS ug
 		LEFT OUTER JOIN cms_usergroups_levels AS ugl ON ugl.id=ug.userlevel
 		WHERE ug.id = :id AND (NOT ug.deleted OR ug.deleted IS NULL)', ['id' => $data['cms_usergroups_id']]);
-    if (!$_SESSION['user']['is_admin'] && ($data && ($data['is_admin'] || ($_SESSION['organisation']['id'] != $requesteduser['organisation_id']) || ($_SESSION['usergroup']['userlevel'] <= $requesteduser['userlevel'])))) {
+    if (!$_SESSION['user']['is_admin']
+        && $data
+        && $data['id'] != $_SESSION['user']['id']
+        && ($data['is_admin']
+         || $_SESSION['organisation']['id'] != $requesteduser['organisation_id']
+         || $_SESSION['usergroup']['userlevel'] <= $requesteduser['userlevel'])) {
         throw new Exception('You do not have access to this user!', 403);
     }