Only admins can create managers accounts.

nilsteampassnet · Oct 3, 2024 · 55d4621 · 55d4621
1 parent 9df0568
commit 55d4621
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 13 deletions.
diff --git a/pages/users.js.php b/pages/users.js.php
@@ -733,6 +733,7 @@ function(data) {
                 $('input[type=radio].only-admin').iCheck('enable');
                 $('#privilege-admin').iCheck('disable');
                 $('#privilege-hr').iCheck('disable');
+                $('#privilege-manager').iCheck('disable');
             } else {
                 $('#privilege-admin').iCheck('disable');
                 $('#privilege-hr').iCheck('disable');

diff --git a/sources/users.queries.php b/sources/users.queries.php
@@ -99,7 +99,7 @@
 
 if (null !== $post_type) {
     switch ($post_type) {
-            /*
+        /*
          * ADD NEW USER
          */
         case 'add_new_user':
@@ -161,6 +161,21 @@
             $post_root_level = filter_var($dataReceived['form-create-root-folder'], FILTER_SANITIZE_NUMBER_INT);
             $mfa_enabled = filter_var($dataReceived['mfa_enabled'], FILTER_SANITIZE_NUMBER_INT);
 
+            // Only administrators can create managers or administrators accounts.
+            if (((int) $is_admin      === 1 && (int) $session->get('user-admin') !== 1)
+                || ((int) $is_manager === 1 && (int) $session->get('user-admin') !== 1)
+                || ((int) $is_hr      === 1 && (int) $session->get('user-admin') !== 1)) {
+
+                echo prepareExchangedData(
+                    array(
+                        'error' => true,
+                        'message' => $lang->get('error_not_allowed_to'),
+                    ),
+                    'encode'
+                );
+                break;
+            }
+
             // Empty user
             if (empty($login) === true) {
                 echo prepareExchangedData(
@@ -182,18 +197,6 @@
             );
 
             if (DB::count() === 0) {
-                // check if admin role is set. If yes then check if originator is allowed
-                if ((int) $dataReceived['admin'] === 1 && (int) $session->get('user-admin') !== 1) {
-                    echo prepareExchangedData(
-                        array(
-                            'error' => true,
-                            'message' => $lang->get('error_not_allowed_to'),
-                        ),
-                        'encode'
-                    );
-                    break;
-                }
-
                 // Generate pwd
                 $password = generateQuickPassword();