Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/UserController.java =================================================================== diff -u -r0fbf2ff50fece085171175031693134a96a7750f -r346836ed4a3680af233482b184e7371ec5b620bc --- lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/UserController.java (.../UserController.java) (revision 0fbf2ff50fece085171175031693134a96a7750f) +++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/UserController.java (.../UserController.java) (revision 346836ed4a3680af233482b184e7371ec5b620bc) @@ -120,7 +120,8 @@ // test requestor's permission Organisation org = null; - Boolean canEdit = userManagementService.isUserGlobalGroupManager(); + boolean isSysAdmin = userManagementService.isUserSysAdmin(); + Boolean canEdit = userManagementService.isUserGlobalGroupManager() || isSysAdmin; if (orgId != null) { org = (Organisation) userManagementService.findById(Organisation.class, orgId); if (!canEdit) { @@ -137,7 +138,10 @@ } } - if (!(canEdit || request.isUserInRole(Role.SYSADMIN))) { + // only sysadmins can edit other sysadmins + canEdit &= isSysAdmin || !userManagementService.isUserSysAdmin(userId); + + if (!canEdit) { request.setAttribute("errorName", "UserController"); request.setAttribute("errorMessage", messageService.getMessage("error.authorisation")); return "error"; Index: lams_common/src/java/org/lamsfoundation/lams/usermanagement/service/IUserManagementService.java =================================================================== diff -u -r2188972474f8d186d6811e3dea2e4136be669335 -r346836ed4a3680af233482b184e7371ec5b620bc --- lams_common/src/java/org/lamsfoundation/lams/usermanagement/service/IUserManagementService.java (.../IUserManagementService.java) (revision 2188972474f8d186d6811e3dea2e4136be669335) +++ lams_common/src/java/org/lamsfoundation/lams/usermanagement/service/IUserManagementService.java (.../IUserManagementService.java) (revision 346836ed4a3680af233482b184e7371ec5b620bc) @@ -402,6 +402,8 @@ */ boolean isUserSysAdmin(); + boolean isUserSysAdmin(Integer userId); + /** * Count then umber of users with a particular role in a given org. * Index: lams_common/src/java/org/lamsfoundation/lams/usermanagement/service/UserManagementService.java =================================================================== diff -u -r8d4e389c1f1f6c95b91080d82960db4478640ced -r346836ed4a3680af233482b184e7371ec5b620bc --- lams_common/src/java/org/lamsfoundation/lams/usermanagement/service/UserManagementService.java (.../UserManagementService.java) (revision 8d4e389c1f1f6c95b91080d82960db4478640ced) +++ lams_common/src/java/org/lamsfoundation/lams/usermanagement/service/UserManagementService.java (.../UserManagementService.java) (revision 346836ed4a3680af233482b184e7371ec5b620bc) @@ -948,9 +948,13 @@ @Override public boolean isUserSysAdmin() { + return isUserSysAdmin(getRequestorId()); + } + + @Override + public boolean isUserSysAdmin(Integer userId) { Integer rootOrgId = getRootOrganisation().getOrganisationId(); - Integer requestorId = getRequestorId(); - return requestorId != null ? isUserInRole(requestorId, rootOrgId, Role.SYSADMIN) : false; + return userId != null && isUserInRole(userId, rootOrgId, Role.SYSADMIN); } @Override