Merge pull request #4878 from sbwalker/dev

User Settings should only be accessible to individual users or administrators
oqtane · Nov 27, 2024 · cdd03bf · cdd03bf
2 parents e83399a + e786c35
commit cdd03bf
Showing 1 changed file with 2 additions and 6 deletions.
diff --git a/Oqtane.Server/Controllers/SettingController.cs b/Oqtane.Server/Controllers/SettingController.cs
@@ -269,11 +269,7 @@ private bool IsAuthorized(string entityName, int entityId, string permissionName
                     authorized = _userPermissions.IsAuthorized(User, _alias.SiteId, entityName, entityId, permissionName);
                     break;
                 case EntityNames.User:
-                    authorized = true;
-                    if (permissionName == PermissionNames.Edit)
-                    {
-                        authorized = _userPermissions.IsAuthorized(User, _alias.SiteId, entityName, -1, PermissionNames.Write, RoleNames.Admin) || (_userPermissions.GetUser(User).UserId == entityId);
-                    }
+                    authorized = _userPermissions.IsAuthorized(User, _alias.SiteId, entityName, -1, PermissionNames.Write, RoleNames.Admin) || (_userPermissions.GetUser(User).UserId == entityId);
                     break;
                 case EntityNames.Visitor:
                     authorized = User.IsInRole(RoleNames.Admin);
@@ -319,7 +315,7 @@ private bool FilterPrivate(string entityName, int entityId)
                     filter = !_userPermissions.IsAuthorized(User, _alias.SiteId, entityName, entityId, PermissionNames.Edit);
                     break;
                 case EntityNames.User:
-                    filter = !User.IsInRole(RoleNames.Admin) && _userPermissions.GetUser(User).UserId != entityId;
+                    filter = !_userPermissions.IsAuthorized(User, _alias.SiteId, entityName, -1, PermissionNames.Write, RoleNames.Admin) && _userPermissions.GetUser(User).UserId != entityId;
                     break;
                 case EntityNames.Visitor:
                     if (!User.IsInRole(RoleNames.Admin))