Fixes

handlers/group.go

@@ -179,10 +179,19 @@ func GroupSave(c *gin.Context, user *models.User) {
 		c.JSON(http.StatusInternalServerError, DBError3Response)
 		return
 	}
-	if groupUser.IsAdmin || user.HasPermission(models.PermissionAdmin) {
+	retiredMembersTokenMap := models.LoadGroupUserIDs(group.ID)
+	sameMembers := len(retiredMembersTokenMap) == len(r.Members)
+	if sameMembers {
+		for _, member := range r.Members {
+			if _, present := retiredMembersTokenMap[member.ID]; !present {
+				sameMembers = false
+			}
+		}
+	}
+	// Update members?
+	if (groupUser.IsAdmin || user.HasPermission(models.PermissionAdmin)) && !sameMembers {
 		// We can edit the Group object...
 		newMembersMap := map[uint64]bool{}
-		retiredMembersTokenMap := models.LoadGroupUserIDs(group.ID)
 		for _, m := range r.Members {
 			newMembersMap[m.ID] = m.IsAdmin
 			delete(retiredMembersTokenMap, m.ID)

handlers/user.go

@@ -116,6 +116,11 @@ func newUserStatusResponse(user *models.User, details bool) UserStatusResponse {
 	return result
 }
 
+func numUsers() (result int) {
+	db.Instance.Raw("select count(*) from users").Scan(&result)
+	return
+}
+
 func UserLogin(c *gin.Context) {
 	postReq := UserLoginRequest{}
 	err := c.ShouldBindJSON(&postReq)
@@ -131,6 +136,10 @@ func UserLogin(c *gin.Context) {
 		}
 	} else if postReq.New {
 		// Check if we have a brand new instance
+		if numUsers() != 0 {
+			c.JSON(http.StatusForbidden, NopeResponse)
+			return
+		}
 		if err = createFirstUser(&postReq); err != nil {
 			c.JSON(http.StatusBadRequest, Response{err.Error()})
 			return