diff --git a/src/Controllers/UserController.php b/src/Controllers/UserController.php index 5a345c6f..d0f19f0b 100644 --- a/src/Controllers/UserController.php +++ b/src/Controllers/UserController.php @@ -33,9 +33,17 @@ class UserController $query = 'fav:' . $user->getName(); elseif ($tab == 'delete') - Access::assert(new Privilege(Privilege::DeleteUser)); + { + Access::assert(new Privilege( + Privilege::DeleteUser, + Access::getIdentity($user))); + } elseif ($tab == 'settings') - Access::assert(new Privilege(Privilege::ChangeUserSettings)); + { + Access::assert(new Privilege( + Privilege::ChangeUserSettings, + Access::getIdentity($user))); + } elseif ($tab == 'edit' and !(new EditUserJob)->canEditAnything(Auth::getCurrentUser())) Access::fail();