root/JobcardSystem
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: correct role lookup in user edit flow

Browse Source
This commit is contained in:
Marco0300
2026-09-02 00:47:21 +02:00
parent 4682e0b2a1
commit a11938ec20
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/index.php
+1 -1
View File
@@ -712,7 +712,7 @@ if ($route === 'user_edit') {
if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') { http_response_code(405); exit('Edit requires POST'); }
verify_csrf();
$targetId = filter_var(scalar_input($_POST['user_id'] ?? null), FILTER_VALIDATE_INT);
$existingUsers = db()->query('SELECT id, name, email, role_id, is_active, role_name FROM users u JOIN roles r ON r.id = u.role_id')->fetchAll();
$existingUsers = db()->query('SELECT id, name, email, role_id, is_active, r.name AS role_name FROM users u JOIN roles r ON r.id = u.role_id')->fetchAll();
$target = null; foreach ($existingUsers as $candidate) if ((int)$candidate['id'] === (int)$targetId) { $target = $candidate; break; }
if (!$target) { http_response_code(404); exit('User not found'); }
$payload = ['name' => $_POST['name'] ?? null, 'email' => $_POST['email'] ?? null, 'role_id' => $_POST['role_id'] ?? null, 'is_active' => isset($_POST['is_active']) ? '1' : '0'];
tests/UserAdministrationTest.php
+2
View File
@@ -19,5 +19,7 @@ $password = $service->validatePasswordReset(['id' => 2], 'Strong-Password-42');
user_admin_assert($password['valid'] === true, 'A strong password reset should pass.');
$front = file_get_contents(dirname(__DIR__) . '/public/index.php');
user_admin_assert($front !== false && str_contains($front, "if (\$route === 'user_edit')") && str_contains($front, "if (\$route === 'user_delete')"), 'User edit and delete routes must exist.');
user_admin_assert(str_contains($front, 'r.name AS role_name FROM users u JOIN roles r'), 'User edit must alias the role name from the roles table.');
user_admin_assert(str_contains($front, "role_name'] ?? '') !== 'Administrator'"), 'User deletion must be Administrator-only.');
printf("User administration tests: 5 passed\n");