meteo/Sentri
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

non-superuser admins cannot update the permission name and description anymore.

Browse Source
This commit is contained in:
Marco
2026-05-16 23:45:28 +02:00
parent 5a27c678b1
commit 38f8584ecf
3 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
pub/api/v1/permissions/index.php
View File

@@ -47,8 +47,10 @@ if ($API_permissions->request_method === 'GET') {
} elseif ($API_permissions->request_method === 'PUT') {
# Update the permission name and description
$API_permissions->checkPermissions('admin-access-control-permissions', 'RW');
# Only superuser can delete permission due to fact that the backend needs programming when setting a permission
if (!$API_permissions->isSuperuser()) {
$API_permissions->apiOutput(401, ['error' => 'You are not authorized to access this resource.']);
}
$requiredFields = [
'permission_uuid' => ['type' => 'uuid'],

3
pub/bin/pages/portal-management/pageAccessControl_permission_edit.php
View File

@@ -18,7 +18,8 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/api/classes/API_permissions.php';
# Check permissions
$API = new API();
if (!$API->checkPermissions('admin-access-control-permissions', 'RW', true)) {
# Only superuser can delete permission due to fact that the backend needs programming when setting a permission
if (!$API->isSuperuser()) {
echo 'error 401 unauthorized';
exit;
}

2
pub/bin/pages/portal-management/pageAccessControl_view.php
View File

@@ -201,7 +201,7 @@ while ($row = $stmt->fetch_assoc()) {
<td class=""><?php echo $permission['permission_description'] ?></td>
<td class="text-nowrap">
<?php if ($API->checkPermissions('admin-access-control-permissions', 'RW', true)) { ?>
<?php if ($API->isSuperuser()) { ?>
<a href="?permission_edit=<?php echo $permission['permission_uuid'] ?>" class="btn btn-primary btn-sm btn-rounded"><i class="fas fa-edit"></i></a>
<?php } ?>