Harden user creation role authorization

2026-06-01 22:55:57 +02:00
parent 7835f068b6
commit ea69c64fad
1 changed files with 7 additions and 2 deletions
@@ -105,8 +105,13 @@ class usersRoute
                if (!isset($data['role'])) {
                    $response->error('Role is required', 400);
                }
+                $role = (int)$data['role'];
+                // Creating users with elevated roles requires the same permission as role edits
+                if ($role !== 0) {
+                    $this->requirePermission('edit_user_role');
+                }
                // Add the user
-                (new users_o())->add($data['customer_number'], $data['password'], (int)$data['role']);
+                (new users_o())->add($data['customer_number'], $data['password'], $role);
                // Log the incident
                (new logs_o())->add('users', 'global', 1, $user->id, 'ADD_USER', 'Successfully added a user');
                // Return a success message
@@ -202,4 +207,4 @@ class usersRoute
            ]
        );
    }
-}
+}