Merge remote-tracking branch 'upstream/master'

2 files changed, 9 insertions, 7 deletions

diff --git a/models/boards.js b/models/boards.js
index 2117ff7c..b5f8b01b 100644
--- a/models/boards.js
+++ b/models/boards.js
@@ -407,10 +407,7 @@ Boards.helpers({
   },
 
   lists() {
-    return Lists.find(
-      { boardId: this._id, archived: false },
-      { sort: { sort: 1 } },
-    );
+    return Lists.find({ boardId: this._id }, { sort: { sort: 1 } });
   },
 
   nullSortLists() {
diff --git a/models/users.js b/models/users.js
index 1adb4a57..55d85e07 100644
--- a/models/users.js
+++ b/models/users.js
@@ -258,9 +258,14 @@ Users.attachSchema(
 );
 
 Users.allow({
-  update(userId) {
-    const user = Users.findOne(userId);
-    return user && Meteor.user().isAdmin; // GitHub issue #2590
+  update(userId, doc) {
+    const user = Users.findOne({ _id: userId });
+    if ((user && user.isAdmin) || (Meteor.user() && Meteor.user().isAdmin))
+      return true;
+    if (!user) {
+      return false;
+    }
+    return doc._id === userId;
   },
   remove(userId, doc) {
     const adminsNumber = Users.find({ isAdmin: true }).count();