Group with no admin access can delete admin user?

Support
1

I created a group with only access to forms and accounts and admin=false, but any user of that group can delete admin accounts. How can i prevent it?

2

Oh, I see the remove function needs some adjustments… In a perfect world, it would have an event to do such checks, like the save function.

You can use this snippet as a temporary workaround in your /config/bootstrap.php:

$app->bind('/accounts/remove', function() {

    if (!$this->module('cockpit')->hasaccess('cockpit', 'accounts')) {
        return $this->helper('admin')->denyRequest();
    }

    if ($data = $this->param('account', false)) {

        // check, if non-admin removes admin
        $account = $this->storage->findOne('cockpit/accounts', ['_id' => $data['_id']]);

        if ($this->module('cockpit')->isSuperAdmin($account['group'])
          && !$this->module('cockpit')->isSuperAdmin()) {
            return $this->helper('admin')->denyRequest();
        }

        // user can't delete himself
        if ($data['_id'] != $this->user['_id']) {

            $this->storage->remove('cockpit/accounts', ['_id' => $data['_id']]);

            return '{"success":true}';
        }
    }

    return false;

});

original function:

When a user isn’t allowed to remove an admin user, there is no GUI feedback.

If you give accounts permissions, you have to check against changes, too. Otherwise users could change the group from admin to a lower one and than they can delete them.

3

Thanks for the solution, it worked