From 2dbd1096d2756a7213209419d1d4da36e7267959 Mon Sep 17 00:00:00 2001 From: Gauthier Date: Sat, 8 Feb 2025 18:12:54 +0100 Subject: [PATCH] fix: disallow admins to edit other admins in bulk edit (#1340) This PR fixes a bug where admin users could edit the permissions of other admins in the bulk edit modal. fix #1309 --- src/components/UserList/BulkEditModal.tsx | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/components/UserList/BulkEditModal.tsx b/src/components/UserList/BulkEditModal.tsx index 3706d2d10..ef33792e5 100644 --- a/src/components/UserList/BulkEditModal.tsx +++ b/src/components/UserList/BulkEditModal.tsx @@ -1,9 +1,10 @@ import Modal from '@app/components/Common/Modal'; import PermissionEdit from '@app/components/PermissionEdit'; import type { User } from '@app/hooks/useUser'; -import { useUser } from '@app/hooks/useUser'; +import { Permission, useUser } from '@app/hooks/useUser'; import globalMessages from '@app/i18n/globalMessages'; import defineMessages from '@app/utils/defineMessages'; +import { hasPermission } from '@server/lib/permissions'; import { useEffect, useState } from 'react'; import { useIntl } from 'react-intl'; import { useToasts } from 'react-toast-notifications'; @@ -79,7 +80,10 @@ const BulkEditModal = ({ const { permissions: allPermissionsEqual } = selectedUsers.reduce( ({ permissions: aPerms }, { permissions: bPerms }) => { return { - permissions: aPerms === bPerms ? aPerms : NaN, + permissions: + aPerms === bPerms || hasPermission(Permission.ADMIN, aPerms) + ? aPerms + : NaN, }; }, { permissions: selectedUsers[0].permissions }