t510599/cavern
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Permission policy updated

Browse Source
This commit is contained in:
Tony Yang 2019-06-02 14:09:48 +08:00
parent 36078c850e
commit 7bf8692753
Signed by: t510599
GPG Key ID: D88388851C28715D
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
admin/ajax/user.php
View File

@ -75,6 +75,10 @@ if ($_SERVER["REQUEST_METHOD"] == "PATCH" || $_SERVER["REQUEST_METHOD"] == "POST
} else if ($level < 0) { } else if ($level < 0) {
$level = 0; $level = 0;
} }
// you cannot promote user to level higher than youself
if ($level > $user->level) {
send_error(403, "lowlevel");
}
$SQL->query("UPDATE `user` SET `muted`='%d', `level`='%d' WHERE `username`='%s'", array($muted, $level, $username)); $SQL->query("UPDATE `user` SET `muted`='%d', `level`='%d' WHERE `username`='%s'", array($muted, $level, $username));

3
admin/component/user.js
View File

@ -192,6 +192,9 @@
case "emailused": case "emailused":
pageManager.snackbar("信箱已被其他使用者使用"); pageManager.snackbar("信箱已被其他使用者使用");
break; break;
case "lowlevel":
pageManager.snackbar("權限不足");
break;
default: default:
pageManager.snackbar("發生錯誤"); pageManager.snackbar("發生錯誤");
break; break;