wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

make some checks server-side

Browse source
This commit is contained in:
Georg Ehrke 2012-11-28 17:57:31 +01:00
parent eaa625c9bc
commit ab13702770
2 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
settings/ajax/togglegroups.php
View file

@ -7,6 +7,12 @@ $success = true;
$username = $_POST["username"];
$group = OC_Util::sanitizeHTML($_POST["group"]);
if($username == OC_User::getUser() && $group == "admin" && OC_Group::inGroup($username, 'admin')){
$l = OC_L10N::get('core');
OC_JSON::error(array( 'data' => array( 'message' => $l->t('Admins can\'t remove themself from the admin group'))));
exit();
}
if(!OC_Group::inGroup(OC_User::getUser(), 'admin') && (!OC_SubAdmin::isUserAccessible(OC_User::getUser(), $username) || !OC_SubAdmin::isGroupAccessible(OC_User::getUser(), $group))) {
$l = OC_L10N::get('core');
OC_JSON::error(array( 'data' => array( 'message' => $l->t('Authentication error') )));

3
settings/js/users.js
View file

@ -165,9 +165,6 @@ var UserList={
}
if(user){
var checkHandeler=function(group){
if(user==OC.currentUser && group=='admin'){
return false;
}
if(!isadmin && checked.length == 1 && checked[0] == group){
return false;
}