fix: prevent manage system assignment from manage groups permission

requarks · May 10, 2022 · 78d02dc · 78d02dc
1 parent a06201a
commit 78d02dc
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/server/graph/resolvers/group.js b/server/graph/resolvers/group.js
@@ -173,6 +173,14 @@ module.exports = {
         throw new gql.GraphQLError('You are not authorized to manage this group or assign these permissions.')
       }
 
+      // Check assigned permissions for manage:groups
+      if (
+        WIKI.auth.checkExclusiveAccess(req.user, ['manage:groups'], ['manage:system']) &&
+        args.permissions.some(p => _.last(p.split(':')) === 'system')
+      ) {
+        throw new gql.GraphQLError('You are not authorized to manage this group or assign the manage:system permissions.')
+      }
+
       // Update group
       await WIKI.models.groups.query().patch({
         name: args.name,