Mirrors/wg-portal
1
0
Fork 0
mirror of https://github.com/h44z/wg-portal.git synced 2026-02-25 03:46:23 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* fix: improve user permission checks

* fix: improve user permission checks
This commit is contained in:
h44z
2026-02-24 22:32:37 +01:00
committed by GitHub
parent 3e0ffec07c
commit bbcda1a033
3 changed files with 85 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
internal/app/api/v0/backend/user_service.go
View File

@@ -54,6 +54,17 @@ func (u UserService) GetAllUsers(ctx context.Context) ([]domain.User, error) {
}
func (u UserService) UpdateUser(ctx context.Context, user *domain.User) (*domain.User, error) {
sessionUser := domain.GetUserInfo(ctx)
currentUser, err := u.users.GetUser(ctx, user.Identifier)
if err != nil {
return nil, err
}
// if this endpoint is used by non-admins, make sure that the user can only modify a specific subset of attributes
if !sessionUser.IsAdmin {
user.CopyAdminAttributes(currentUser, u.cfg.Advanced.ApiAdminOnly)
}
return u.users.UpdateUser(ctx, user)
}