From 02094904be3d959e7555ef588b1b672569767b21 Mon Sep 17 00:00:00 2001
From: Alex van Andel <me@alexvanandel.com>
Date: Sun, 23 Apr 2023 18:43:23 +0200
Subject: [PATCH] Patch vulnerability that allowed self-promotion

---
 pages/api/users/[userId]/_patch.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pages/api/users/[userId]/_patch.ts b/pages/api/users/[userId]/_patch.ts
index 1d823f067f..59d8b76f94 100644
--- a/pages/api/users/[userId]/_patch.ts
+++ b/pages/api/users/[userId]/_patch.ts
@@ -94,6 +94,11 @@ export async function patchHandler(req: NextApiRequest) {
   if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 
   const body = await schemaUserEditBodyParams.parseAsync(req.body);
+  // disable role changes unless admin.
+  if (!isAdmin && body.role) {
+    body.role = undefined;
+  }
+
   const userSchedules = await prisma.schedule.findMany({
     where: { userId: query.userId },
   });