Corrected access checks for #215 and #252

vitalidze · Sep 8, 2015 · 5e76b87 · 5e76b87
1 parent 8bb189e
commit 5e76b87
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/src/main/java/org/traccar/web/client/view/UserDialog.java b/src/main/java/org/traccar/web/client/view/UserDialog.java
@@ -151,8 +151,9 @@ public String getValue(DeviceEventType object) {
             grid.getSelectionModel().select(deviceEventType, true);
         }
 
-        if (ApplicationContext.getInstance().getUser().getAdmin() || ApplicationContext.getInstance().getUser().getManager()) {
-            admin.setEnabled(true);
+        User currentUser = ApplicationContext.getInstance().getUser();
+        if (currentUser.getAdmin() || currentUser.getManager()) {
+            admin.setEnabled(currentUser.getAdmin());
             manager.setEnabled(true);
             readOnly.setEnabled(true);
             expirationDate.setEnabled(true);

diff --git a/src/main/java/org/traccar/web/server/model/DataServiceImpl.java b/src/main/java/org/traccar/web/server/model/DataServiceImpl.java
@@ -263,7 +263,9 @@ public User updateUser(User user) {
                 {
                     currentUser.setMaxNumOfDevices(user.getMaxNumOfDevices());
                     currentUser.setExpirationDate(user.getExpirationDate());
-                    currentUser.setAdmin(user.getAdmin());
+                    if (currentUser.getAdmin()) {
+                        currentUser.setAdmin(user.getAdmin());
+                    }
                     currentUser.setManager(user.getManager());
                 }
                 currentUser.setUserSettings(user.getUserSettings());