diff --git a/src/app/user/controllers/UserController.php b/src/app/user/controllers/UserController.php index 53dcd96bead3c3a036b5a668acf73dcb6399f725..768cdaf2d4fefcdc83319cceaf2ff9772f93830b 100755 --- a/src/app/user/controllers/UserController.php +++ b/src/app/user/controllers/UserController.php @@ -106,7 +106,9 @@ class UserController return $response->withStatus(400)->withJson(['errors' => 'Route id is not an integer']); } - if ($GLOBALS['id'] == $args['id'] || PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'manage_users'])) { + $queryParams = $request->getQueryParams(); + $summaryOnly = ($queryParams['mode'] ?? null) == 'summary'; + if (!$summaryOnly && ($GLOBALS['id'] == $args['id'] || PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'manage_users']))) { $user = UserController::getUserInformationsById(['id' => $args['id']]); } else { $user = UserModel::getById(['select' => ['id', 'firstname', 'lastname', 'email', 'phone', 'substitute'], 'id' => $args['id']]); @@ -130,7 +132,7 @@ class UserController if (!empty($groupsIds)) { $groups = GroupModel::get(['select' => ['label', 'id'], 'where' => ['id in (?)'], 'data' => [$groupsIds]]); $user['groups'] = $groups; - } elseif (!$actuallyAlone) { + } elseif (!$actuallyAlone && !$summaryOnly) { return $response->withStatus(403)->withJson(['errors' => 'User out of perimeter']); } @@ -957,7 +959,7 @@ class UserController $groupsIntersection = array_intersect($targetUserGroups, $activeUserManageableGroups); if (empty($args['targetGroupId'])) { - return !empty($groupsIntersection); + return $args['activeUserId'] == $args['targetUserId'] || !empty($groupsIntersection); } return in_array($args['targetGroupId'], $groupsIntersection);