Update: 2026-05-04 01:33:55

2026-05-04 01:33:55 +03:00
parent ad48142492
commit 90f2f6f6e3
6 changed files with 251 additions and 42 deletions
--- a/app/modules_app/users/create.php
+++ b/app/modules_app/users/create.php
@@ -19,7 +19,7 @@ $data = input();
 // 1. Role Authorization check (Prevent Role Escalation)
 $allowedRoles = match($decoded['role']) {
    'super_admin' => ['super_admin', 'admin', 'accountant', 'employee', 'viewer'],
-    'admin'       => ['accountant', 'employee', 'viewer'], 
+    'admin'       => ['accountant', 'employee', 'viewer'], // Cannot create other admins
    default       => []
 };