Commit a44d7497 authored by Prasad's avatar Prasad
Browse files

Fixes #1126: Restrict role changes by non-admin

parent 604bc834

modules/Users/actions/Save.php

+4 −0
Original line number Diff line number Diff line
@@ -69,6 +69,10 @@ class Users_Save_Action extends Vtiger_Save_Action { 
			if ($fieldName == 'is_owner') {

				$fieldValue = null;

			}

			if ($fieldName == 'roleid' && !($currentUserModel->isAdminUser())) {

				$fieldValue = null;

			}



			if($fieldValue !== null) {

				if(!is_array($fieldValue)) {

					$fieldValue = trim($fieldValue);

modules/Users/actions/SaveAjax.php

+1 −1
Original line number Diff line number Diff line
@@ -86,7 +86,7 @@ class Users_SaveAjax_Action extends Vtiger_SaveAjax_Action { 
			$recordModel->set($fieldName, 'off');

		}



		if($fieldName == "is_owner") {

		if($fieldName == "is_owner" || $fieldName == "roleid") {

			$recordId = $request->get('record');

			$moduleName = $request->getModule();

			if(!empty($recordId)) {

Copyright 2026 Vtiger. All rights reserved.