From f5bee51cbfdad3f31f5ef9d06459619667f17f0c Mon Sep 17 00:00:00 2001 From: Gabriel Jenik Date: Fri, 27 Nov 2015 19:56:43 -0300 Subject: [PATCH] Fixed Issue #10062: SuperAdmin can't add users to not-owned UserGroups --- application/controllers/admin/usergroups.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/application/controllers/admin/usergroups.php b/application/controllers/admin/usergroups.php index b004bdcbfee..40d75b42d76 100644 --- a/application/controllers/admin/usergroups.php +++ b/application/controllers/admin/usergroups.php @@ -278,7 +278,8 @@ public function index($ugid = false, $header = false) $eguquery = "SELECT * FROM {{user_in_groups}} AS a INNER JOIN {{users}} AS b ON a.uid = b.uid WHERE ugid = " . $ugid . " ORDER BY b.users_name"; $eguresult = dbExecuteAssoc($eguquery); $aUserInGroupsResult = $eguresult->readAll(); - $query2 = "SELECT ugid FROM {{user_groups}} WHERE ugid = " . $ugid . " AND owner_id = " . Yii::app()->session['loginID']; + $query2 = "SELECT ugid FROM {{user_groups}} WHERE ugid = " . $ugid; + if (!Permission::model()->hasGlobalPermission('superadmin','read')) $query2 .= " AND owner_id = " . Yii::app()->session['loginID']; $result2 = dbSelectLimitAssoc($query2, 1); $row2 = $result2->readAll(); $row = 1;