[pull] develop from LibreBooking:develop - #579
Merged
Merged
Conversation
The group admin user management page reuses ManageUsersPresenter, whose updateUser action flows through the unscoped ManageUsersService. A group administrator could modify any user's username, email, name, and attributes. Deny ManageUsersService::UpdateUser() unless the session belongs to an application administrator, matching the existing DeleteUser and UpdatePassword guards. The REST API update endpoint was already restricted via AddAdminPost. Hide the edit button, edit menu item, and edit dialog for non-application administrators with a new CanEditUsers template flag, and note the restriction in the administration guide. Assisted-by: Claude:claude-fable-5
The group admin user management page exposed the addUser, importUsers, and inviteUsers actions. A group administrator could create accounts with passwords they chose and the CSV import path could additionally update existing users. Deny ManageUsersService::AddUser() unless the session belongs to an application administrator, and guard the ImportUsers and InviteUsers presenter actions, following the existing ImportReservations pattern. The presenter's AddUser action tolerates the service's null denial return. Hide the add, invite, and import controls and dialogs for non-application administrators with a new CanCreateUsers template flag, and note the restriction in the administration guide. Assisted-by: Claude:claude-fable-5
Make the roles, groupAdmin, adminGroups, resourceGroups, scheduleGroups, and import actions in ManageGroupsPresenter enforce on the server side that the current session belongs to an application administrator, following the same guard pattern used for the recent user management changes. Previously only the page templates controlled which of these actions were presented. Group role assignment and administered group, resource, and schedule associations are application administrator responsibilities under the delegated administration model, as is the group CSV import, which can also assign roles and create groups. Hide the group import menu item and dialog on the group admin page with a new CanImportGroups flag, matching the existing CanChangeRoles handling, and document the restriction in the administration guide. Assisted-by: Claude:claude-fable-5
Make the dr=export data requests on the manage users and manage groups pages enforce on the server side that the current session belongs to an application administrator, following the guard pattern used in the recent delegated administration changes. The group export includes the full group permission list, which is application administrator material under the delegated administration model. Hide the Export menu items with new CanExportUsers and CanExportGroups flags, and hide the header dropdown toggles entirely when no items in them are available. Document the restriction in the administration guide. Assisted-by: Claude:claude-fable-5
… admins Make the activate, deactivate, permissions, changeCredits, changeColor, and changeAttribute actions on the manage users page enforce on the server side that the current session belongs to an application administrator, completing the delegated administration model for user management: group administrators manage group membership and reservations on behalf of members, while account state and properties are application administrator responsibilities. Self-registration and email verification activation flows are unaffected; the guards apply only to the administrative page actions. Hide or render read-only the corresponding controls for group administrators: status toggle, credits inline edit, reservation color editor, permissions menu item and dialog, and inline custom attribute editing. Update the administration guide to enumerate the restrictions. Assisted-by: Claude:claude-fable-5
Reject malformed reservation colors submitted through the manage users action before updating user preferences. Apply the same validation to CSV imports, ignoring invalid colors while allowing the rest of the row to be imported. Accept only empty values or six-digit hexadecimal colors in #RRGGBB format. Add presenter coverage confirming that crafted color values are not persisted. Assisted-by: Codex:gpt-5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )