synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-03 16:13:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: Prevent role changing on yourself. (#1931)

Browse Source 
* feat: Prevent role changing on yourself.

Only allow changing roles on other users. Not much value in self changing
at the moment
This commit is contained in:
Steven Masley
2022-05-31 15:50:38 -05:00
committed by GitHub
parent 4b0ed06a26
commit 7acb742218
3 changed files with 32 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
coderd/users.go
View File

@ -474,6 +474,14 @@ func (api *API) putUserRoles(rw http.ResponseWriter, r *http.Request) {
// User is the user to modify.
user := httpmw.UserParam(r)
roles := httpmw.UserRoles(r)
apiKey := httpmw.APIKey(r)
if apiKey.UserID == user.ID {
httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
Message: "You cannot change your own roles.",
})
return
}
var params codersdk.UpdateRoles
if !httpapi.Read(rw, r, &params) {