diff --git a/src/app/user/controllers/UserController.php b/src/app/user/controllers/UserController.php index 142157718f3716aa7d5c03fc86d1ac14ddcefe9d..ae060a9498c0db49328a9440e8c23fa9d756cdc5 100755 --- a/src/app/user/controllers/UserController.php +++ b/src/app/user/controllers/UserController.php @@ -106,8 +106,12 @@ class UserController return $response->withStatus(400)->withJson(['errors' => 'Route id is not an integer']); } + if ($GLOBALS['id'] == $args['id'] || PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'manage_users'])) { $user = UserController::getUserInformationsById(['id' => $args['id']]); + if (empty($user)) { + return $response->withStatus(400)->withJson(['errors' => 'User does not exist']); + } $user['groups'] = []; $userGroups = UserGroupModel::get(['select' => ['group_id'], 'where' => ['user_id = ?'], 'data' => [$args['id']]]); $groupsIds = array_column($userGroups, 'group_id'); @@ -119,7 +123,6 @@ class UserController } else { $user = UserModel::getById(['select' => ['id', 'firstname', 'lastname', 'email', 'phone', 'substitute'], 'id' => $args['id']]); } - if (empty($user)) { return $response->withStatus(400)->withJson(['errors' => 'User does not exist']); }