From e8326fd7e83c27e134af06109c32f8b8871aded9 Mon Sep 17 00:00:00 2001 From: Ibrahim Serdar Acikgoz Date: Fri, 7 Aug 2020 09:41:22 +0300 Subject: [PATCH] api4/bot: fix permission check in convert handler (#15196) --- api4/bot.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api4/bot.go b/api4/bot.go index def2d13ba6..7d186cf004 100644 --- a/api4/bot.go +++ b/api4/bot.go @@ -406,7 +406,7 @@ func convertBotToUser(c *Context, w http.ResponseWriter, r *http.Request) { auditRec.AddMeta("userPatch", userPatch) auditRec.AddMeta("set_system_admin", systemAdmin) - if c.Params.UserId != c.App.Session().UserId && !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) return }