XWIKI-19804: Bulletproof user API

xwiki · Jun 9, 2022 · 0b732f2 · 0b732f2
1 parent 5be1cc0
commit 0b732f2
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java
@@ -92,7 +92,9 @@ public XWikiUser getUser()
      */
     public void setDisabledStatus(boolean disabledStatus)
     {
-        this.user.setDisabled(disabledStatus, getXWikiContext());
+        if (hasAdminRights()) {
+            this.user.setDisabled(disabledStatus, getXWikiContext());
+        }
     }
 
     /**