starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-08-07 12:28:39 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

fix(auth): prevent admin users from deleting the root account

Browse Source
This commit is contained in:
mikiher
2026-07-15 20:34:02 +03:00
parent 6f03467f35
commit 3c016314e6
3 changed files with 192 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/controllers/UserController.js
+7 -2
View File
@@ -363,7 +363,13 @@ class UserController {
* @param {Response} res
*/
async delete(req, res) {
if (req.params.id === 'root') {
const user = req.reqUser
if (user.isRoot && !req.user.isRoot) {
Logger.error(`[UserController] Admin user "${req.user.username}" attempted to delete root user`)
return res.sendStatus(403)
}
if (user.isRoot) {
Logger.error('[UserController] Attempt to delete root user. Root user cannot be deleted')
return res.sendStatus(400)
}
@@ -371,7 +377,6 @@ class UserController {
Logger.error(`[UserController] User ${req.user.username} is attempting to delete self`)
return res.sendStatus(400)
}
const user = req.reqUser
// Todo: check if user is logged in and cancel streams