fix(frontend): Do not allow user w/ ID 1 to disable 'Admin' permission (#965)

This commit is contained in:
TheCatLady
2021-02-18 20:20:32 -05:00
committed by GitHub
parent bdb3cb2025
commit 77b2d9ea22
5 changed files with 37 additions and 14 deletions

View File

@@ -266,6 +266,13 @@ userSettingsRoutes.post<
return next({ status: 404, message: 'User not found.' });
}
if (user.id === 1) {
return next({
status: 500,
message: 'Permissions for user with ID 1 cannot be modified',
});
}
user.permissions = req.body.permissions;
await userRepository.save(user);