diff options
Diffstat (limited to 'api4/user.go')
| -rw-r--r-- | api4/user.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/api4/user.go b/api4/user.go index 8d4a264f8..5e97122d7 100644 --- a/api4/user.go +++ b/api4/user.go @@ -583,6 +583,12 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) { return } + // The user being updated in the payload must be the same one as indicated in the URL. + if user.Id != c.Params.UserId { + c.SetInvalidParam("user_id") + return + } + if !c.App.SessionHasPermissionToUser(c.Session, user.Id) { c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS) return |