meteo/Sentri
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Users are not able to change their own name.

Browse Source
This commit is contained in:
Marco
2026-06-13 15:16:43 +02:00
parent ec82b2add0
commit 9de2fc0ad1
3 changed files with 56 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
pub/api/classes/API_users.php
View File

@@ -108,15 +108,27 @@ The Sentri gnomes';
$_GET['builder'] = [1 => ['where' => [0 => 'user_uuid', 1 => $this->data['user_uuid']]]];
$this->getUser();
if ($this->getUserGroupWeight() < $_SESSION['user']['user_group_weight']) {
$this->apiOutput(400, ['error' => 'You cannot edit a user with an lower weight then yourself!']);
if (!isset($this->postedData['user_profile_change']) && $this->getUserGroupWeight() < $_SESSION['user']['user_group_weight']) {
$this->apiOutput(400, ['error' => 'You cannot edit a user with a lower weight than yourself!']);
}
$query = "UPDATE system_users SET user_group_uuid = ?, user_email = ?, user_first_name = ?, user_last_name = ?, user_full_name = ?, user_phone_number = ?, user_status = ?, user_pref_language = ?, user_modified_timestamp = ?, user_stompable = ? WHERE user_uuid = ?";
$stmt = $this->prepareStatement($query);
$stmt->bind_param('ssssssssiis', $this->data['user_group_uuid'], $this->data['user_email'], $this->data['user_first_name'], $this->data['user_last_name'], $this->data['user_full_name'], $this->data['user_phone_number'], $this->data['user_status'], $this->data['user_pref_language'], time(), $this->data['user_stompable'], $this->data['user_uuid']);
$data = $this->data;
$this->executeStatement($stmt);
$userUuid = $data['user_uuid'];
unset($data['user_uuid']);
# always set timestamp
$data['user_modified_timestamp'] = time();
$set = [];
foreach ($data as $key => $value) {
$set[] = "$key = :$key";
}
$sql = sprintf("UPDATE system_users SET %s WHERE user_uuid = :user_uuid", implode(', ', $set));
$stmt = $GLOBALS['pdo']->prepare($sql);
$data['user_uuid'] = $userUuid;
$stmt->execute($data);
$this->apiOutput(200, ['success' => 'User successfully updated.']);
}