1. class
  2. Poweradmin
  3. \
  4. Domain
  5. \
  6. Service
  7. \
  8. SelfEditFieldGuard

SelfEditFieldGuard

class SelfEditFieldGuard (View source)

Gates auth-critical fields on user self-edit API paths (#1327).

A caller with only user_edit_own may edit their contact fields but not username (login/audit identity), use_ldap (disabling it converts the account to local auth), or active. Unchanged values pass so GET->PUT round-tripping clients keep working.

Constants

RESTRICTED_FIELDS

Fields a self-editor without user_edit_others may not change.

Methods

static string|null
apply(PermissionService $permissionService, int $callerId, int $targetUserId, array $currentUser, array $input)

Apply the gate to an update input array.

Details

at line 46
static string|null apply(PermissionService $permissionService, int $callerId, int $targetUserId, array $currentUser, array $input)

Apply the gate to an update input array.

Parameters

PermissionService $permissionService
int $callerId
int $targetUserId
array $currentUser

Stored users row for the target (expects username, use_ldap, active).
array $input

Decoded request body.

Return Value

string|null

Error message to surface as 403, or null if the input passes.