From: Brion Vibber <brion@users.mediawiki.org>
Date: Fri, 28 Dec 2007 02:29:37 +0000 (+0000)
Subject: Validate permissions on application. :)
X-Git-Tag: 1.31.0-rc.0~50250
X-Git-Url: http://git.cyclocoop.org/%7B%24www_url%7Dadmin/password.php?a=commitdiff_plain;h=7d9a33408e677a646b2b4ebd44a1088f1b0acb75;p=lhc%2Fweb%2Fwiklou.git

Validate permissions on application. :)
---

diff --git a/includes/SpecialUserrights.php b/includes/SpecialUserrights.php
index a2d78c7096..634fb3f2e6 100644
--- a/includes/SpecialUserrights.php
+++ b/includes/SpecialUserrights.php
@@ -101,13 +101,17 @@ class UserrightsForm extends HTMLForm {
 		if(isset($removegroup)) {
 			$newGroups = array_diff($newGroups, $removegroup);
 			foreach( $removegroup as $group ) {
-				$user->removeGroup( $group );
+				if( $this->canRemove( $group ) ) {
+					$user->removeGroup( $group );
+				}
 			}
 		}
 		if(isset($addgroup)) {
 			$newGroups = array_merge($newGroups, $addgroup);
 			foreach( $addgroup as $group ) {
-				$user->addGroup( $group );
+				if( $this->canAdd( $group ) ) {
+					$user->addGroup( $group );
+				}
 			}
 		}
 		$newGroups = array_unique( $newGroups );