Improved access checks in notifications config.

[timetracker.git] / WEB-INF / lib / ttUser.class.php

diff --git a/WEB-INF/lib/ttUser.class.php b/WEB-INF/lib/ttUser.class.php
index 7867ac8..5c21879 100644 (file)
--- a/WEB-INF/lib/ttUser.class.php
+++ b/WEB-INF/lib/ttUser.class.php
@@ -594,15 +594,10 @@ class ttUser {
 
   // updateGroup updates group information with new data.
   function updateGroup($fields) {
-    if (!($this->can('manage_basic_settings') ||
-      $this->can('manage_advanced_settings') ||
-      $this->can('manage_features'))) return false;
-    // TODO: update the above for subgroup updates.
+    $mdb2 = getConnection();
 
     $group_id = $fields['group_id'];
     if ($group_id && !$this->isGroupValid($group_id)) return false;
-
-    $mdb2 = getConnection();
     if (!$group_id) $group_id = $this->getGroup();
 
     if (isset($fields['name'])) $name_part = ', name = '.$mdb2->quote($fields['name']);