From ea69c64fade87c03915f934f44ace59ccb7b6697 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 22:55:57 +0200
Subject: [PATCH] Harden user creation role authorization

---
 services/nginx/app/routes/usersRoute.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/services/nginx/app/routes/usersRoute.php b/services/nginx/app/routes/usersRoute.php
index 3df700b8..dc3aa324 100644
--- a/services/nginx/app/routes/usersRoute.php
+++ b/services/nginx/app/routes/usersRoute.php
@@ -105,8 +105,13 @@ class usersRoute
                 if (!isset($data['role'])) {
                     $response->error('Role is required', 400);
                 }
+                $role = (int)$data['role'];
+                // Creating users with elevated roles requires the same permission as role edits
+                if ($role !== 0) {
+                    $this->requirePermission('edit_user_role');
+                }
                 // Add the user
-                (new users_o())->add($data['customer_number'], $data['password'], (int)$data['role']);
+                (new users_o())->add($data['customer_number'], $data['password'], $role);
                 // Log the incident
                 (new logs_o())->add('users', 'global', 1, $user->id, 'ADD_USER', 'Successfully added a user');
                 // Return a success message
@@ -202,4 +207,4 @@ class usersRoute
             ]
         );
     }
-}
\ No newline at end of file
+}