KumiSystems/vpnmanager
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Prevent privilege escalation

Browse source
This commit is contained in:
Kumi 2019-01-17 09:52:38 +01:00
parent edcf42eff7
commit 51eb63bed7
2 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
manager/templates/manager/edituser.html
View file

@ -26,6 +26,12 @@
<label class="form-check-label" for="staff">Grant special privileges to user</label>
</div>
{% endif %}
{% if user.is_superuser %}
<div class="form-group form-check">
<input class="form-check-input" type="checkbox" value="True" {% if auser.is_superuser %} checked {% endif %} id="superuser" name="superuser">
<label class="form-check-label" for="superuser">Grant superuser privileges to user</label>
</div>
{% endif %}
<input hidden value="sent" name="form"/>
<button type="submit" class="btn btn-success">Apply Changes</button>

8
manager/views.py
View file

@ -334,7 +334,13 @@ def edituser(request, user_id):
if request.POST.get("form", ""):
user[0].first_name = request.POST.get("firstname", "")
user[0].last_name = request.POST.get("lastname", "")
user[0].is_staff = True if request.POST.get("staff", "0") == "True" else False
if request.user.is_staff or request.user.is_superuser:
user[0].is_staff = True if request.POST.get("staff", "0") == "True" else False
if request.user.is_superuser:
user[0].is_superuser = True if request.POST.get("superuser", "0") == "True" else False
user[0].email = request.POST.get("email", "")
user[0].save()