fixes:

returning Forbidden in place of Conflict, superuser not need to be checked in hasAnyPermission()
aces · Apr 24, 2024 · c13c615 · c13c615
1 parent e94920d
commit c13c615
Showing 1 changed file with 2 additions and 7 deletions.
diff --git a/modules/examiner/php/addexaminer.class.inc b/modules/examiner/php/addexaminer.class.inc
@@ -66,15 +66,10 @@ class AddExaminer extends \NDB_Page
 
         // check for site permissions
         $user = \User::singleton();
-        if (!$user->hasAnyPermission(
-            [
-                'superuser',
-                'examiner_multisite',
-            ]
-        )
+        if (!$user->hasAnyPermission('examiner_multisite')
             && !in_array($siteID, $user->getCenterIDs())
         ) {
-            return  new \LORIS\Http\Response\JSON\Conflict(
+            return new \LORIS\Http\Response\JSON\Forbidden(
                 'Permission denied: You cannot assign examiner to this Site.'
             );
         };