Trigger checking MaintainUsers priv before updating table to avoid bug 24255

diff --git a/foundation-database/public/trigger_functions/usrpriv.sql b/foundation-database/public/trigger_functions/usrpriv.sql
index 7ab0098..b35a826 100644 (file)
--- a/foundation-database/public/trigger_functions/usrpriv.sql
+++ b/foundation-database/public/trigger_functions/usrpriv.sql
@@ -1,4 +1,4 @@
-CREATE OR REPLACE FUNCTION _usrprivTrigger() RETURNS TRIGGER AS $$
+CREATE OR REPLACE FUNCTION _usrprivTrigger() RETURNS TRIGGER AS $$
 -- Copyright (c) 1999-2014 by OpenMFG LLC, d/b/a xTuple. 
 -- See www.xtuple.com/CPAL for the full text of the software license.
 DECLARE
@@ -8,6 +8,13 @@ BEGIN
   -- This looks like a candidate for a foreign key but isn't.
   -- fkeys don't work if the foreign key value resides in a child of the 
   -- table and not the table itself.
+  IF (NOT EXISTS(SELECT usrpriv_id 
+                 FROM usrpriv, priv  
+                 WHERE ((usrpriv_priv_id=priv_id) AND (priv_name ='MaintainUsers')
+                        AND (usrpriv_username=geteffectivextuser())))) THEN
+    RAISE EXCEPTION 'User have no privileges to modify user privileges.';
+  END IF;                
+
   IF ((TG_OP = 'UPDATE' OR TG_OP = 'INSERT') AND
       (NOT EXISTS(SELECT priv_id
                   FROM priv