fix: hardened user API

Author: thorsten

phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/UserController.php

@@ -370,6 +370,13 @@ public function addUser(Request $request): JsonResponse
         $userPasswordConfirm = Filter::filterVar($data->passwordConfirm, FILTER_SANITIZE_SPECIAL_CHARS);
         $userIsSuperAdmin = Filter::filterVar($data->isSuperAdmin, FILTER_VALIDATE_BOOLEAN);
 
+        // Only SuperAdmins may grant the SuperAdmin flag. Reject the request when a
+        // non-SuperAdmin attempts to set it, to prevent privilege escalation through
+        // mass-assignment of is_superadmin on user creation.
+        if (!$this->currentUser->isSuperAdmin() && (bool) $userIsSuperAdmin) {
+            return $this->json(['error' => Translation::get(key: 'msgNoPermission')], Response::HTTP_FORBIDDEN);
+        }
+
         $newUser = new User($this->configuration);
 
         if (!$newUser->isValidLogin($userName)) {

tests/phpMyFAQ/Controller/Administration/Api/UserControllerTest.php

@@ -243,4 +243,28 @@ public function testUpdateRightsNonSuperAdminCannotGrantRightTheyDoNotHold(): vo
 
         $this->assertSame(Response::HTTP_FORBIDDEN, $response->getStatusCode());
     }
+
+    public function testAddUserNonSuperAdminCannotGrantSuperAdminFlag(): void
+    {
+        $session = new Session(new MockArraySessionStorage());
+        // Acting user holds USER_ADD/EDIT/DELETE but is NOT a SuperAdmin.
+        $actingUser = $this->buildActingUser(userId: 5, isSuperAdmin: false);
+        $controller = $this->buildController($session, $actingUser);
+        $csrf = $this->primeCsrf($session, 'add-user');
+
+        $request = $this->jsonRequest([
+            'csrf' => $csrf,
+            'userName' => 'evil_superadmin',
+            'realName' => 'Evil SA',
+            'email' => 'evil@example.test',
+            'automaticPassword' => false,
+            'password' => 'Sup3rSecret!42',
+            'passwordConfirm' => 'Sup3rSecret!42',
+            'isSuperAdmin' => true, // privilege escalation attempt
+        ]);
+
+        $response = $controller->addUser($request);
+
+        $this->assertSame(Response::HTTP_FORBIDDEN, $response->getStatusCode());
+    }
 }