[TikiWiki-commits] [Git][tikiwiki/tiki][29.x] [BP][FIX] Prevent wrong user deletion from user preferences page

luci pushed to branch 29.x at Tiki Wiki CMS Groupware / Tiki


Commits:
3fe326e6 by Elifeleti Mukisa Dan at 2026-04-03T22:07:59+00:00
[BP][FIX] Prevent wrong user deletion from user preferences page
---
* [BP][FIX] Prevent wrong user deletion from user preferences page
---
* [FIX] Prevent wrong user deletion from user preferences page
---
* [FIX] prevent wrong user deletion from user preferences page

See merge request tikiwiki/tiki!9695


(cherry picked from commit 38e8cae784d52629521f097323dbe9218cf9ae7a)

327c5a71 [FIX] prevent wrong user deletion from user preferences page

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9927


(cherry picked from commit 897ebabfe578237755333a89d51cdfe105d736cc)

4f5874a1 [FIX] Prevent wrong user deletion from user preferences page

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9930

- - - - -


2 changed files:

- templates/tiki-user_preferences.tpl
- tiki-user_preferences.php


Changes:

=====================================
templates/tiki-user_preferences.tpl
=====================================
@@ -720,7 +720,7 @@
                 <form action="tiki-user_preferences.php" method="post">
                     {include file='password_jq.tpl'}
                     {ticket}
-                    <input type="hidden" name="view_user" value="{$userwatch|escape}">
+                    {if $userwatch ne $user}<input type="hidden" name="view_user" value="{$userwatch|escape}">{/if}
                         {if $prefs.auth_method neq 'cas' || ($prefs.cas_skip_admin eq 'y' && $user eq 'admin')}
                             {if $prefs.change_password neq 'n' and ($prefs.login_is_email ne 'y' or $userinfo.login eq 'admin')}
                                 {remarksbox type="tip" title="{tr}Information{/tr}" close="n"}
@@ -738,7 +738,8 @@
                                 {tr}Username:{/tr}
                             </label>
                             <div class="col-md-8">
-                                <input type="text" class="form-control" name="username-autocomplete" id="username-autocomplete" disabled="disabled" value="{$userinfo.login|escape}" autocomplete="username">
+                                <input type="hidden" name="username" value="{$userinfo.login|escape}">
+                                <input type="text" class="form-control" id="username-autocomplete" disabled="disabled" value="{$userinfo.login|escape}">
                             </div>
                         </div>
                         {if $prefs.login_is_email eq 'y' and $userinfo.login neq 'admin'}
@@ -806,8 +807,8 @@
             {remarksbox type="error" title="{tr}Two-factor authentication is required{/tr}" close="n"}{tr}Your access to the site is restricted until you enable <strong>Two-factor authentication</strong>. Please enable Two-factor authentication to keep using normally the site.{/tr}{/remarksbox}
         {/if}
         {remarksbox type="tip"}
-            {tr}Two-factor authentication is a security measure that requires an extra code when you log in. 
-            When enabled, Tiki will prompt you for a TOTP code generated by any authenticator app 
+            {tr}Two-factor authentication is a security measure that requires an extra code when you log in.
+            When enabled, Tiki will prompt you for a TOTP code generated by any authenticator app
             (FreeOTP, Authy, Google Authenticator, etc.).{/tr}
         {/remarksbox}
         {if $tfaSecret }
@@ -819,10 +820,10 @@
                         {if $imageType eq 'svg+xml'}
                             {assign var="fileExtension" value="svg"}
                         {else}
-                            {assign var="fileExtension" value="png"} 
+                            {assign var="fileExtension" value="png"}
                         {/if}
                         {capture assign="downloadFileName"}tfa_qr_code.{$fileExtension}{/capture}
-                      
+
 
                         <div class="mt-1 d-flex justify-content-center align-items-center gap-2">
                             <button type="button" class="btn btn-sm btn-secondary" id="downloadQrCode">
@@ -832,7 +833,7 @@
                                 {tr}Show Secret Code{/tr}
                             </button>
                         </div>
-                    
+
                         <div id="secretContainer" class="d-none mt-3 text-center">
                             <strong>{tr}Secret Code:{/tr}</strong>
                             <span id="secretField">{$tfaSecret}</span>
@@ -846,14 +847,14 @@
                         <div class="d-flex mt-4">
                             <div class="well">
                                 {tr}Install a soft token authenticator like FreeOTP or Google Authenticator from your application repository and use that app to scan this QR code. More information is available in the documentation.{/tr} <a href="https://en.wikipedia.org/wiki/Comparison_of_OTP_applications" target="_blank">{tr}Learn more about authenticator apps{/tr}</a>
-                                
+
                                 <div class="well mt-3">
                                     {tr}Scan this QR code with your TOTP authenticator app (FreeOTP, Google Authenticator, etc.). For security, consider saving this QR code or secret key as a backup so you can restore it if you lose or change your device.{/tr}
                                 </div>
 
                                 <div style="margin-top: 20px" class="tiki-form-group">
                                     <label for="authCode">{tr}2FA Code{/tr}</label>
-                                    <input type="text" class="form-control" name="tfaPin" id="authCode" placeholder="{tr}Enter the 6-digit code from your authenticator app{/tr}">                                
+                                    <input type="text" class="form-control" name="tfaPin" id="authCode" placeholder="{tr}Enter the 6-digit code from your authenticator app{/tr}">
                                 </div>
                             </div>
                         </div>
@@ -863,7 +864,7 @@
                         </div>
                     </div>
                 </div>
-                
+
             </form>
         {else}
             <form action="tiki-user_preferences.php" method="post">
@@ -883,13 +884,13 @@
     {/if}
     {*Do not give access to tab Account Deletion, if 2FA is required but not enabled by the user, except for the user 'admin'*}
     {if $prefs.twoFactorAuth neq 'y' or $force2FA neq 'y' or ! empty($twoFactorSecret)}
-        {if $tiki_p_delete_account eq 'y' and $userinfo.login neq 'admin'}
+        {if ($tiki_p_delete_account eq 'y' or ($tiki_p_admin_users eq 'y' and $userwatch ne $user)) and $userinfo.login neq 'admin'}
             {tab name="{tr}Account Deletion{/tr}"}
                 <div class="jumbotron text-center">
                     <h2>{tr}Account Deletion{/tr}</h2>
                     <form action="tiki-user_preferences.php" method="post">
                         {ticket}
-                        {if !empty($userwatch)}<input type="hidden" name="view_user" value="{$userwatch|escape}">{/if}
+                        <input type="hidden" name="view_user" value="{$userwatch|escape}">
                         <p>
                             <div class="form-check">
                                 <input type='checkbox' class="form-check-input" name='deleteaccountconfirm' id="deleteaccountconfirm" value='1'>
@@ -899,7 +900,7 @@
                             </div>
                         </p>
                         <p>
-                            <input type="submit" class="btn btn-danger btn-lg" name="deleteaccount" value="{if !empty($userwatch)}{tr}Delete the account:{/tr} {$userwatch|escape}{else}{tr}Delete my account{/tr}{/if}" onclick="confirmPopup('{tr _0=$userwatch|escape}Delete account for %0?{/tr}')">
+                            <input type="submit" class="btn btn-danger btn-lg" name="deleteaccount" value="{if $userwatch ne $user}{tr}Delete the account:{/tr} {$userwatch|escape}{else}{tr}Delete my account{/tr}{/if}" onclick="confirmPopup('{if $userwatch ne $user}{tr _0=$userwatch|escape}Delete account for %0?{/tr}{else}{tr}Delete my account?{/tr}{/if}')">
                         </p>
                     </form>
                 </div>


=====================================
tiki-user_preferences.php
=====================================
@@ -16,7 +16,7 @@ $inputConfiguration = [
     [
         'staticKeyFilters'                => [
         'userId'                          => 'int',          //post
-        'view_user'                       => 'int',          //post
+        'view_user'                       => 'username',     //post
         'generate'                        => 'bool',         //post
         'tfagenerate'                     => 'bool',         //post
         'new_info'                        => 'bool',         //post
@@ -555,15 +555,51 @@ if ($prefs['twoFactorAuth'] == 'y' && $generate && $prefs['twoFactorAuthType'] =
     $smarty->assign('imageType', $imageType);
 }
 
-if (isset($_POST['deleteaccount']) && $tiki_p_delete_account == 'y' && $access->checkCsrf(true)) {
-    $userlib->remove_user($userwatch);
+if (isset($_POST['deleteaccount']) && $access->checkCsrf(true)) {
+    if (! isset($_POST['deleteaccountconfirm'])) {
+        $smarty->assign('msg', tra('Please check the confirmation box to delete the account.'));
+        $smarty->display('error.tpl');
+        die();
+    }
+    // Determine the target user explicitly from the POST form data to prevent
+    // mismatch with $userwatch which is derived from $_REQUEST (GET+POST merged).
+    // Never fall back to $user to avoid accidentally deleting the logged-in admin.
+    if (empty($_POST['view_user'])) {
+        $smarty->assign('msg', tra('Invalid request: no target user specified.'));
+        $smarty->display('error.tpl');
+        die();
+    }
+    $deleteUser = $_POST['view_user'];
+    if (empty($userlib->user_exists($deleteUser))) {
+        $smarty->assign('msg', tra('Unknown user'));
+        $smarty->display('error.tpl');
+        die();
+    }
+    // Non-admin users can only delete their own account
+    if ($deleteUser !== $user && $tiki_p_admin_users !== 'y') {
+        $smarty->assign('msg', tra('You do not have permission to delete other accounts.'));
+        $smarty->display('error.tpl');
+        die();
+    }
+    if ($deleteUser === $user && $tiki_p_delete_account !== 'y') {
+        $smarty->assign('msg', tra('You do not have permission to delete your own account.'));
+        $smarty->display('error.tpl');
+        die();
+    }
+    // Prevent deletion of the built-in admin account
+    if ($deleteUser === 'admin') {
+        $smarty->assign('msg', tra('The built-in admin account cannot be deleted.'));
+        $smarty->display('error.tpl');
+        die();
+    }
+    $userlib->remove_user($deleteUser);
 
     $unifiedsearchlib = TikiLib::lib('unifiedsearch');
-    $unifiedsearchlib->invalidateObject('user', $userwatch);
+    $unifiedsearchlib->invalidateObject('user', $deleteUser);
 
-    if ($user == $userwatch) {
+    if ($user === $deleteUser) {
         header('Location: tiki-logout.php');
-    } elseif ($tiki_p_admin_users == 'y') {
+    } elseif ($tiki_p_admin_users === 'y') {
         header('Location: tiki-adminusers.php');
     } else {
         header("Location: $base_url");



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3fe326e629a351ac62fcb635002d72932b3719af

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3fe326e629a351ac62fcb635002d72932b3719af
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs