add owner protection for reseller center

usmannasir · Feb 18, 2020 · 266cfc8 · 266cfc8
2 parents c683ef3 + 25ef1dd
commit 266cfc8
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/userManagment/views.py b/userManagment/views.py
@@ -908,9 +908,16 @@ def saveResellerChanges(request):
         else:
             return ACLManager.loadErrorJson()
 
+        loggedUser = Administrator.objects.get(pk=val)
+
         userToBeModified = Administrator.objects.get(userName=data['userToBeModified'])
         newOwner = Administrator.objects.get(userName=data['newOwner'])
 
+        ### Check user owners
+
+        if ACLManager.checkUserOwnerShip(currentACL, loggedUser, userToBeModified) == 0 or ACLManager.checkUserOwnerShip(currentACL, loggedUser, newOwner) == 0:
+            return ACLManager.loadErrorJson()
+
         try:
             if ACLManager.websitesLimitCheck(newOwner, data['websitesLimit'], userToBeModified) == 0:
                 finalResponse = {'status': 0,

diff --git a/websiteFunctions/static/websiteFunctions/websiteFunctions.css b/websiteFunctions/static/websiteFunctions/websiteFunctions.css
@@ -236,4 +236,4 @@ a:hover {
 
 .btn-min-width {
     min-width: 300px;
-}
+}