From 16da573a8f07eecffddeea037202478306b5e5ce Mon Sep 17 00:00:00 2001
From: Mike Koch <mkoch227@gmail.com>
Date: Wed, 15 Oct 2014 22:43:20 -0400
Subject: [PATCH] #61 Only allow those with access to the settings page to give
 others access

---
 admin/manage_users.php | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/admin/manage_users.php b/admin/manage_users.php
index eb7f4983..f678dfc3 100644
--- a/admin/manage_users.php
+++ b/admin/manage_users.php
@@ -276,10 +276,11 @@ require_once(HESK_PATH . 'inc/show_admin_nav.inc.php');
                             <div class="checkbox">
                                 <label><input type="checkbox" name="autoassign" value="Y" <?php if ( ! isset($_SESSION['userdata']['autoassign']) || $_SESSION['userdata']['autoassign'] == 1 ) {echo 'checked="checked"';} ?> /> <?php echo $hesklang['user_aa']; ?></label>
                             </div>
-                            <?php } ?>
+                            <?php } if ($_SESSION['can_manage_settings']) { ?>
                             <div class="checkbox">
                                     <label><input type="checkbox" name="manage_settings"> Can Manage Settings (!)</label>
                             </div>
+                            <?php } ?>
                         </div>
                     </div>
                     <div class="form-group">
@@ -688,7 +689,12 @@ function edit_user()
                         <?php } if ($_GET['id'] != 1) { ?>
                             <div class="checkbox">
                                 <?php if (isset($_SESSION['userdata']['can_manage_settings'])) { ?>
-                                    <label><input type="checkbox" name="manage_settings" <?php if ($_SESSION['userdata']['can_manage_settings']) { echo 'checked';} ?>> Can Manage Settings (!)</label>
+                                    <label><input type="checkbox" name="manage_settings"
+                                            <?php if ($_SESSION['userdata']['can_manage_settings']) { echo 'checked="checked"';} ?>
+                                            <?php if (!$_SESSION['can_manage_settings']) { echo 'disabled'; } ?>> Can Manage Settings (!)</label>
+                                    <?php if (!$_SESSION['can_manage_settings'] && $_SESSION['userdata']['can_manage_settings']) {
+                                        echo '<input type="hidden" name="manage_settings" value="1">';
+                                    } ?>
                                 <?php } ?>
                             </div>
                         <?php } else { ?>