fix: #12057, allow gmods to change user email

NodeBB · Oct 4, 2023 · 344ece8 · 344ece8
1 parent 56794cf
commit 344ece8
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 7 deletions.
diff --git a/public/src/client/account/edit.js b/public/src/client/account/edit.js
@@ -27,7 +27,7 @@ define('forum/account/edit', [
 		updateAboutMe();
 		handleGroupSort();
 
-		if (!ajaxify.data.isSelf && app.user.isAdmin) {
+		if (!ajaxify.data.isSelf && ajaxify.data.canEdit) {
 			$(`a[href="${config.relative_path}/user/${ajaxify.data.userslug}/edit/email"]`).on('click', () => {
 				changeEmail.init({
 					uid: ajaxify.data.uid,

diff --git a/src/api/users.js b/src/api/users.js
@@ -413,10 +413,9 @@ usersAPI.getInviteGroups = async (caller, { uid }) => {
 };
 
 usersAPI.addEmail = async (caller, { email, skipConfirmation, uid }) => {
-	const canManageUsers = await privileges.admin.can('admin:users', caller.uid);
-	skipConfirmation = canManageUsers && skipConfirmation;
-
-	if (skipConfirmation) {
+	const isSelf = parseInt(caller.uid, 10) === parseInt(uid, 10);
+	const canEdit = await privileges.users.canEdit(caller.uid, uid);
+	if (skipConfirmation && canEdit && !isSelf) {
 		if (!email.length) {
 			await user.email.remove(uid);
 		} else {

diff --git a/src/privileges/users.js b/src/privileges/users.js
@@ -77,17 +77,20 @@ privsUsers.canEdit = async function (callerUid, uid) {
 	if (parseInt(callerUid, 10) === parseInt(uid, 10)) {
 		return true;
 	}
-	const [isAdmin, isGlobalMod, isTargetAdmin] = await Promise.all([
+	const privsAdmin = require('./admin');
+	const [isAdmin, isGlobalMod, isTargetAdmin, canManageUsers] = await Promise.all([
 		privsUsers.isAdministrator(callerUid),
 		privsUsers.isGlobalModerator(callerUid),
 		privsUsers.isAdministrator(uid),
+		privsAdmin.can('admin:users', callerUid),
 	]);
 
 	const data = await plugins.hooks.fire('filter:user.canEdit', {
 		isAdmin: isAdmin,
 		isGlobalMod: isGlobalMod,
 		isTargetAdmin: isTargetAdmin,
-		canEdit: isAdmin || (isGlobalMod && !isTargetAdmin),
+		canManageUsers: canManageUsers,
+		canEdit: isAdmin || ((isGlobalMod || canManageUsers) && !isTargetAdmin),
 		callerUid: callerUid,
 		uid: uid,
 	});