diff --git a/modules/backend/controllers/Users.php b/modules/backend/controllers/Users.php index 14c12288a..ddc4c2961 100644 --- a/modules/backend/controllers/Users.php +++ b/modules/backend/controllers/Users.php @@ -49,6 +49,11 @@ class Users extends Controller */ public function __construct() { + // Prevent non-superusers from even seeing the is_superuser filter + $this->listConfig = $this->makeConfig($this->listConfig); + $this->listConfig->filter = $this->makeConfig($this->listConfig->filter); + unset($this->listConfig->filter->scopes['is_superuser']); + parent::__construct(); if ($this->action == 'myaccount') { @@ -59,6 +64,26 @@ class Users extends Controller SettingsManager::setContext('October.System', 'administrators'); } + /** + * Extends the list query to hide superusers if the current user is not a superuser themselves + */ + public function listExtendQuery($query) + { + if (!$this->user->isSuperUser()) { + $query->where('is_superuser', false); + } + } + + /** + * Extends the form query to prevent non-superusers from accessing superusers at all + */ + public function formExtendQuery($query) + { + if (!$this->user->isSuperUser()) { + $query->where('is_superuser', false); + } + } + /** * Update controller */ @@ -114,7 +139,6 @@ class Users extends Controller if (!$this->user->isSuperUser()) { $form->removeField('is_superuser'); - $form->removeField('role'); } /*