Merge pull request #208 from copenhagentruckwash/fix-arbitrary-group_id-role-assignment

Harden role authorization on user creation

services/nginx/app/routes/usersRoute.php

@@ -105,8 +105,13 @@ class usersRoute
                 if (!isset($data['role'])) {
                     $response->error('Role is required', 400);
                 }
+                $role = (int)$data['role'];
+                // Creating users with elevated roles requires the same permission as role edits
+                if ($role !== 0) {
+                    $this->requirePermission('edit_user_role');
+                }
                 // Add the user
-                (new users_o())->add($data['customer_number'], $data['password'], (int)$data['role']);
+                (new users_o())->add($data['customer_number'], $data['password'], $role);
                 // Log the incident
                 (new logs_o())->add('users', 'global', 1, $user->id, 'ADD_USER', 'Successfully added a user');
                 // Return a success message
@@ -202,4 +207,4 @@ class usersRoute
             ]
         );
     }
-}
+}