Users with admin-access-control-permissions RW are no longer able to change superuser permissions.

pub/api/classes/API.php

@@ -688,7 +688,7 @@ class API
 
     protected function buildDynamicQuery(string $tableName): array
     {
-        unset($this->baseQuery);
+        $this->baseQuery = '';
         if (!$this->baseQuery) {
             $this->baseQuery = "SELECT * FROM " . $tableName;
         }

pub/api/v1/access-rights/index.php

@@ -14,7 +14,6 @@ if ($API_permissions->request_method === 'GET') {
     # to be made, get all the access-rights and implement the builder
 
 } elseif ($API_permissions->request_method === 'PUT') {
-
     # when called from the frontend will not be forwarding to a url since when its called from the frontend it doesnt need a redirection
     $API_permissions->return_url = false;
 
@@ -34,7 +33,13 @@ if ($API_permissions->request_method === 'GET') {
 
     # check if the user_group_uuid exists
     $_GET['builder'] = [1 => ['where' => [0 => 'user_group_uuid', 1 => $API_permissions->data['user_group_uuid']]]];
-    $API_usergroups->getUsergroup();
+    $user_group = $API_usergroups->getUsergroup();
+
+    # if the user updating the permissions is in a lower group (higher group weight number) prevent them for doing so to prevent
+    # Privilege escalation.
+    if ($user_group[0]['user_group_weight'] < $_SESSION['user']['user_group_weight']) {
+        $API_permissions->apiOutput(405, ['error' => 'You are not allowed to update this user since you are in a lower group']);
+    }
 
     # Update the permission
     $API_permissions->updateAccessRights();

pub/bin/locales/en.php

@@ -301,4 +301,5 @@ return [
     'source_inserve_sync_licenses_desc' => 'This API call first executes the <b>Sync cloud distributor companies</b> action and then synchronizes all servers in an active, deleted, or trial state with Inserve licenses. It creates or updates server licenses in Inserve if they do not exist or if the license quantities differ from those in Sentri.',
     'source_inserve_sync_subscriptions' => 'Sync server subscriptions',
     'source_inserve_sync_subscriptions_desc' => 'This API call first executes the <b>Sync cloud distributor</b> companies action and then creates a subscription if it does not exist, or updates the subscription description if it does. It also creates subscription lines with the correct product_code entered in the <b>custom source data</b> JSON field.',
+    'not_allowed_to_change_due_to_group_weight' => 'You are not permitted to modify these settings because has a lower group weight, which is used to enforce hierarchy and prevent privilege escalation.',
 ];

pub/bin/locales/nl.php

@@ -301,4 +301,5 @@ return [
     'source_inserve_sync_licenses_desc' => 'Deze API-call voert eerst de <b>Synchroniseer cloud-distributeurbedrijven</b> actie uit en synchroniseert daarna alle servers in een actieve, verwijderde of trial status met Inserve-licenties. Het maakt serverlicenties in Inserve aan of werkt ze bij als ze niet bestaan of als de licentieaantallen afwijken van die in Sentri.',
     'source_inserve_sync_subscriptions' => 'Synchroniseer serverabonnementen',
     'source_inserve_sync_subscriptions_desc' => 'Deze API-call voert eerst de actie <b>Sync cloud distributor companies</b> uit en maakt vervolgens een abonnement aan als dit nog niet bestaat, of werkt de beschrijving van het abonnement bij als het wel bestaat. Daarnaast worden abonnementsregels aangemaakt met de juiste product_code die is ingevuld in het <b>custom source data</b> JSON-veld.',
+    'not_allowed_to_change_due_to_group_weight' => 'U mag deze instellingen niet wijzigen omdat deze een lagere groepsgewichtwaarde hebben, wat wordt gebruikt om de hiërarchie af te dwingen en privilege-escalatie te voorkomen.'
 ];

pub/bin/pages/portal-management/pageAccessControl_user_group_view.php

@@ -46,6 +46,15 @@ $stmt = $GLOBALS['pdo']->prepare($query);
 $stmt->execute([$user_group_uuid]);
 $group_permissions = $stmt->fetchAll(PDO::FETCH_ASSOC);
 
+$toggleDisabled = false;
+if ($user_group['user_group_weight'] < $_SESSION['user']['user_group_weight']) {
+    $toggleDisabled = true;
+}
+
+if (!$API->checkPermissions('admin-access-control-permissions', 'RW', true)) {
+    $toggleDisabled = true;
+}
+
 # Set breadcrumb data
 array_push($GLOBALS['breadCrumbArray'], array('display' => __('user_groups'), 'href' => '/accesscontrol/#user-groups'));
 array_push($GLOBALS['breadCrumbArray'], array('display' => $user_group['user_group_name'], 'href' => ''));
@@ -121,28 +130,35 @@ $pageNavbar->outPutNavbar();
                 </tr>
                 </tfoot>
                 <tbody>
-                <?php
+
+
+                <?php if ($toggleDisabled) { ?>
+                    <div class="alert alert-warning" role="alert">
+                        <?php echo __('not_allowed_to_change_due_to_group_weight') ?>
+                    </div>
+                <?php }
+
                 foreach ($group_permissions as $group_permissions_data) { ?>
                     <tr>
                         <td><?php echo $group_permissions_data['permission_name'] ?> </td>
                         <td>
                             <label class="switch">
                                 <input type="checkbox" class="checkbox" data-permission-uuid="<?= $group_permissions_data['permission_uuid'] ?>" data-user-group-uuid="<?= $group_permissions_data['user_group_uuid'] ?>" data-value="NA" data-api-url="/api/v1/access-rights/" <?php echo(($group_permissions_data['permission_value'] == 'NA') ? 'checked' : '') ?>
-                                        <?php echo ($API->checkPermissions('admin-access-control-permissions', 'RW', true)) ? '' : 'disabled' ?>>
+                                        <?php echo ($toggleDisabled) ? 'disabled' : '' ?>>
                                 <div class="slider"></div>
                             </label>
                         </td>
                         <td>
                             <label class="switch">
                                 <input type="checkbox" class="checkbox" data-permission-uuid="<?= $group_permissions_data['permission_uuid'] ?>" data-user-group-uuid="<?= $group_permissions_data['user_group_uuid'] ?>" data-value="RO" data-api-url="/api/v1/access-rights/" <?php echo(($group_permissions_data['permission_value'] == 'RO') ? 'checked' : '') ?>
-                                        <?php echo ($API->checkPermissions('admin-access-control-permissions', 'RW', true)) ? '' : 'disabled' ?>>
+                                        <?php echo ($toggleDisabled) ? 'disabled' : '' ?>>
                                 <div class="slider"></div>
                             </label>
                         </td>
                         <td>
                             <label class="switch">
                                 <input type="checkbox" class="checkbox" data-permission-uuid="<?= $group_permissions_data['permission_uuid'] ?>" data-user-group-uuid="<?= $group_permissions_data['user_group_uuid'] ?>" data-value="RW" data-api-url="/api/v1/access-rights/" <?php echo(($group_permissions_data['permission_value'] == 'RW') ? 'checked' : '') ?>
-                                        <?php echo ($API->checkPermissions('admin-access-control-permissions', 'RW', true)) ? '' : 'disabled' ?>>
+                                        <?php echo ($toggleDisabled) ? 'disabled' : '' ?>>
                                 <div class="slider"></div>
                             </label>
                         </td>