prevent user from removing the current backend session (#5371)

redaxo · Oct 13, 2022 · 59c7c0c · 59c7c0c
1 parent facc1a1
commit 59c7c0c
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/redaxo/src/core/pages/profile.sessions.php b/redaxo/src/core/pages/profile.sessions.php
@@ -4,6 +4,13 @@
 
 $list->addColumn('remove_session', '<i class="rex-icon rex-icon-delete"></i>', 0, ['<th class="rex-table-icon"></th>', '<td class="rex-table-icon">###VALUE###</td>']);
 $list->setColumnParams('remove_session', ['function' => 'remove_session', 'session_id' => '###session_id###']);
+$list->setColumnFormat('remove_session', 'custom', static function () use ($list) {
+    // prevent removing the current session
+    if ($list->getValue('session_id') === session_id()) {
+        return '';
+    }
+    return $list->getColumnLink('remove_session', $list->getValue('remove_session'));
+});
 $list->addLinkAttribute('remove_session', 'data-confirm', rex_i18n::msg('confirm_remove_session'));
 
 $list->setColumnLabel('session_id', rex_i18n::msg('session_id'));