CB-465 Restrict edit own roles

2026-09-24 16:04:36 +08:00 · 2020-11-05 20:56:51 +03:00
parent 73aaca6687
commit 0211ac63e2
1 changed files with 3 additions and 0 deletions
@@ -167,6 +167,9 @@ public class WebServiceAdmin implements DBWServiceAdmin {
        if (grantor == null) {
            throw new DBWebException("Cannot grant role in anonymous mode");
        }
+        if (CommonUtils.equalObjects(user, webSession.getUser().getUserId())) {
+            throw new DBWebException("You cannot edit your own permissions");
+        }
        try {
            WebRole[] userRoles = CBPlatform.getInstance().getApplication().getSecurityController().getUserRoles(user);
            List<String> roleIds = Arrays.stream(userRoles).map(WebRole::getRoleId).collect(Collectors.toList());