Fixed issue: [security] Superadmin can delete a protected superadmin

LimeSurvey · Apr 24, 2020 · 0e47d3f · 0e47d3f
1 parent 8c582d2
commit 0e47d3f
Showing 1 changed file with 7 additions and 7 deletions.
diff --git a/application/controllers/UserManagementController.php b/application/controllers/UserManagementController.php
@@ -689,10 +689,7 @@ public function actionDeleteMultiple()
             $aResults[$user]['title'] = $model->users_name;
             $aResults[$user]['result'] = $this->deleteUser($user);
             if (!$aResults[$user]['result'] && $user == Yii::app()->user->id) {
-                $aResults[$user]['error'] = gT("You cannot delete yourself.");
-            }
-            if (Permission::isForcedSuperAdmin($user)) {
-                $aResults[$user]['error'] = gT("You have no permission to delete this user.");
+                $aResults[$user]['error'] = gT("You cannot delete yourself or a protected user.");
             }
         }
 
@@ -964,10 +961,13 @@ public function deleteUser(int $uid)
 
         if ($uid == Yii::app()->user->id) {
             return false;
-        } else {
-            $oUser = User::model()->findByPk($uid);
-            return $oUser->delete();
         }
+        if (Permission::isForcedSuperAdmin($uid)) {
+            return false;
+        }
+
+        $oUser = User::model()->findByPk($uid);
+        return $oUser->delete();
     }
 
     /**