#10180 Restrict permission levels for JMs creating roles (main)

pkp · Jul 9, 2024 · ce0f337 · ce0f337
1 parent 5f27f71
commit ce0f337
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/controllers/grid/settings/roles/form/UserGroupForm.php b/controllers/grid/settings/roles/form/UserGroupForm.php
@@ -198,7 +198,11 @@ public function execute(...$functionParams)
         // Check if we are editing an existing user group or creating another one.
         if ($userGroupId == null) {
             $userGroup = Repo::userGroup()->newDataObject();
-            $userGroup->setRoleId($this->getData('roleId'));
+
+            $roleId = $this->getData('roleId');
+            if ($roleId == Role::ROLE_ID_SITE_ADMIN) throw new \Exception('Site administrator roles cannot be created here.');
+            $userGroup->setRoleId($roleId);
+
             $userGroup->setContextId($this->getContextId());
             $userGroup->setDefault(false);
             $userGroup->setShowTitle(is_null($this->getData('showTitle')) ? false : $this->getData('showTitle'));