Users with user management permission can now change all user's passwords except full admins.
Ylian Saint-Hilaire committed
Mar 17, 2020 at 13:39 UTC
e374d8a83955d88fa814a9cf2e0b754c401dc1cb
2 files changed
+5
-2
meshuser.js
+4
-1
@@ -1983,7 +1983,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1983
case 'changeuserpass':
1984
{
1985
// Change a user's password
1986
- if (user.siteadmin != 0xFFFFFFFF) break;
1986
+ if ((user.siteadmin & 2) == 0) break;
1987
if (common.validateString(command.userid, 1, 256) == false) break;
1988
if (common.validateString(command.pass, 0, 256) == false) break;
1989
if ((command.hint != null) && (common.validateString(command.hint, 0, 256) == false)) break;
@@ -1992,6 +1992,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1992
1993
var chguser = parent.users[command.userid];
1994
if (chguser) {
1995
+ // If we are not full administrator, we can't change anything on a different full administrator
1996
+ if ((user.siteadmin != 0xFFFFFFFF) & (chguser.siteadmin == 0xFFFFFFFF)) break;
1997
+
1998
// Can only perform this operation on other users of our group.
1999
if ((user.groups != null) && (user.groups.length > 0) && ((chguser.groups == null) || (findOne(chguser.groups, user.groups) == false))) break;
2000
views/default.handlebars
+1
-1
@@ -10064,7 +10064,7 @@
10064
x = '<div style=float:right;font-size:x-small>';
10065
if (deletePossible) x += '<a href=# style=cursor:pointer onclick=\'return p30showDeleteUserDialog()\' title="Remove this user">' + "Delete User" + '</a>';
10066
x += '</div><div style=font-size:x-small>';
10067
- if (userinfo.siteadmin == 0xFFFFFFFF) x += '<a href=# style=cursor:pointer onclick=\'return p30showUserChangePassDialog(' + multiFactor + ')\' title="' + "Change the password for this user" + '">' + "Change Password" + '</a>';
10067
+ if (((userinfo.siteadmin & 2) && (user.siteadmin != 0xFFFFFFFF)) || (userinfo.siteadmin == 0xFFFFFFFF)) x += '<a href=# style=cursor:pointer onclick=\'return p30showUserChangePassDialog(' + multiFactor + ')\' title="' + "Change the password for this user" + '">' + "Change Password" + '</a>';
10068
x += '</div><br>'
10069
QH('p30html3', x);
10070