search

cablelabs / lpwanserver

LPWAN Provisioning & Management Server
https://lpwanserver.com
Apache License 2.0
37 stars 11 forks source link

user can change their own role to ADMIN so long as they have an email address #263

Closed rhythnic closed 5 years ago

rhythnic commented 5 years ago

The update for user seems to fail to check that the acting user is an admin if the target user is being updated to admin role.

rhythnic commented 5 years ago

It turns out that a user can't update themselves to admin. It happens implicitly, by not copying the role property from the request payload to the data object used to update the record.