Secure created_by like other core components

2021-08-17 23:24:43 +07:00 · 2021-08-17 23:24:43 +07:00 · b668befbb2
parent f6a5e30925
commit b668befbb2
1 changed files with 6 additions and 0 deletions
--- a/src/administrator/components/com_weblinks/src/Model/WeblinkModel.php
+++ b/src/administrator/components/com_weblinks/src/Model/WeblinkModel.php
@ -142,6 +142,12 @@ class WeblinkModel extends AdminModel
 			$form->setFieldAttribute('publish_down', 'filter', 'unset');
 		}

+		// Don't allow to change the created_by user if not allowed to access com_users.
+		if (!Factory::getApplication()->getIdentity()->authorise('core.manage', 'com_users'))
+		{
+			$form->setFieldAttribute('created_by', 'filter', 'unset');
+		}
+
 		return $form;
 	}