fix: admin api can operate self

server/handlers/admin.go

@@ -371,6 +371,12 @@ func BanUser(ctx *gin.Context) {
 		return
 	}
 
+	if req.ID == user.ID {
+		log.Error("cannot ban self")
+		ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorStringResp("cannot ban self"))
+		return
+	}
+
 	u, err := op.LoadOrInitUserByID(req.ID)
 	if err != nil {
 		log.WithError(err).Error("load or init user by id error")
@@ -656,6 +662,7 @@ func BanRoom(ctx *gin.Context) {
 		return
 	}
 
+	if r.CreatorID != user.ID {
 		creator, err := db.GetUserByID(r.CreatorID)
 		if err != nil {
 			log.WithError(err).Error("get user by id error")
@@ -674,6 +681,7 @@ func BanRoom(ctx *gin.Context) {
 			ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("cannot ban admin"))
 			return
 		}
+	}
 
 	err = op.SetRoomStatusByID(req.Id, dbModel.RoomStatusBanned)
 	if err != nil {
@@ -761,6 +769,12 @@ func DeleteUser(ctx *gin.Context) {
 		return
 	}
 
+	if u.Value().ID == user.ID {
+		log.Error("cannot delete yourself")
+		ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorStringResp("cannot delete yourself"))
+		return
+	}
+
 	if u.Value().IsRoot() {
 		log.Error("cannot delete root")
 		ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorStringResp("cannot delete root"))
@@ -799,6 +813,7 @@ func AdminDeleteRoom(ctx *gin.Context) {
 		return
 	}
 
+	if r.CreatorID != user.ID {
 		u, err := op.LoadOrInitUserByID(r.CreatorID)
 		if err != nil {
 			log.WithError(err).Error("get user by id error")
@@ -818,6 +833,7 @@ func AdminDeleteRoom(ctx *gin.Context) {
 			ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("cannot delete admin's room"))
 			return
 		}
+	}
 
 	if err := op.DeleteRoomByID(req.Id); err != nil {
 		log.WithError(err).Error("delete room by id error")
@@ -845,6 +861,7 @@ func AdminUserPassword(ctx *gin.Context) {
 		return
 	}
 
+	if u.Value().ID != user.ID {
 		if u.Value().IsRoot() {
 			log.Error("cannot change root password")
 			ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorStringResp("cannot change root password"))
@@ -856,6 +873,7 @@ func AdminUserPassword(ctx *gin.Context) {
 			ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("cannot change admin password"))
 			return
 		}
+	}
 
 	if err := u.Value().SetPassword(req.Password); err != nil {
 		log.WithError(err).Error("set password error")
@@ -883,6 +901,7 @@ func AdminUsername(ctx *gin.Context) {
 		return
 	}
 
+	if u.Value().ID != user.ID {
 		if u.Value().IsRoot() {
 			log.Error("cannot change root username")
 			ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorStringResp("cannot change root username"))
@@ -894,6 +913,7 @@ func AdminUsername(ctx *gin.Context) {
 			ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("cannot change admin username"))
 			return
 		}
+	}
 
 	if err := u.Value().SetUsername(req.Username); err != nil {
 		log.WithError(err).Error("set username error")
@@ -921,6 +941,7 @@ func AdminRoomPassword(ctx *gin.Context) {
 		return
 	}
 
+	if r.Value().CreatorID != user.ID {
 		creator, err := op.LoadOrInitUserByID(r.Value().CreatorID)
 		if err != nil {
 			log.WithError(err).Error("load or init user by id error")
@@ -939,6 +960,7 @@ func AdminRoomPassword(ctx *gin.Context) {
 			ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("cannot change admin room password"))
 			return
 		}
+	}
 
 	if err := r.Value().SetPassword(req.Password); err != nil {
 		log.WithError(err).Error("set password error")