Improved input checking for role editor.

[timetracker.git] / role_add.php

diff --git a/role_add.php b/role_add.php
index e4cbb96..d26cb6a 100644 (file)
--- a/role_add.php
+++ b/role_add.php
@@ -40,7 +40,7 @@ if (!ttAccessAllowed('manage_roles')) {
 if ($request->isPost()) {
   $cl_name = trim($request->getParameter('name'));
   $cl_description = trim($request->getParameter('description'));
-  $cl_rank = (int) $request->getParameter('rank');
+  $cl_rank = (int)$request->getParameter('rank');
 }
 
 $form = new Form('roleForm');
@@ -56,6 +56,7 @@ if ($request->isPost()) {
   // Validate user input.
   if (!ttValidString($cl_name)) $err->add($i18n->get('error.field'), $i18n->get('label.thing_name'));
   if (!ttValidString($cl_description, true)) $err->add($i18n->get('error.field'), $i18n->get('label.description'));
+  if ($cl_rank >= $user->rank || $cl_rank < 0) $err->add($i18n->get('error.field'), $i18n->get('form.roles.rank'));
 
   if ($err->no()) {
     $existing_role = ttRoleHelper::getRoleByRank($cl_rank, $user->team_id);