diff --git a/install/package.json b/install/package.json index 60da0583e8..f0380e242d 100644 --- a/install/package.json +++ b/install/package.json @@ -148,7 +148,7 @@ "zxcvbn": "4.4.2" }, "devDependencies": { - "@apidevtools/swagger-parser": "10.0.3", + "@apidevtools/swagger-parser": "9.0.0", "@commitlint/cli": "17.4.1", "@commitlint/config-angular": "17.4.0", "coveralls": "3.1.1", diff --git a/src/api/users.js b/src/api/users.js index c23f2c04d6..e0382c95cd 100644 --- a/src/api/users.js +++ b/src/api/users.js @@ -307,18 +307,17 @@ async function isPrivilegedOrSelfAndPasswordMatch(caller, data) { async function processDeletion({ uid, method, password, caller }) { const isTargetAdmin = await user.isAdministrator(uid); const isSelf = parseInt(uid, 10) === parseInt(caller.uid, 10); - const isAdmin = await user.isAdministrator(caller.uid); + const hasAdminPrivilege = await privileges.admin.can('admin:users', caller.uid); if (isSelf && meta.config.allowAccountDelete !== 1) { throw new Error('[[error:account-deletion-disabled]]'); - } else if (!isSelf && !isAdmin) { + } else if (!isSelf && !hasAdminPrivilege) { throw new Error('[[error:no-privileges]]'); } else if (isTargetAdmin) { throw new Error('[[error:cant-delete-admin]'); } // Privilege checks -- only deleteAccount is available for non-admins - const hasAdminPrivilege = await privileges.admin.can('admin:users', caller.uid); if (!hasAdminPrivilege && ['delete', 'deleteContent'].includes(method)) { throw new Error('[[error:no-privileges]]'); } diff --git a/src/privileges/admin.js b/src/privileges/admin.js index 5a733d30f4..166236ac76 100644 --- a/src/privileges/admin.js +++ b/src/privileges/admin.js @@ -66,6 +66,7 @@ privsAdmin.routeMap = { uploadDefaultAvatar: 'admin:settings', }; privsAdmin.routePrefixMap = { + 'dashboard/': 'admin:dashboard', 'manage/categories/': 'admin:categories', 'manage/privileges/': 'admin:privileges', 'manage/groups/': 'admin:groups',