Fix "incorrectly sets user group to 'user' when not specified in PUT …

…method".
eesast · Sep 25, 2018 · cc65668 · cc65668
1 parent 4397f79
commit cc65668
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/routes/users.js b/routes/users.js
@@ -268,7 +268,11 @@ router.put("/:id", verifyToken, async (req, res) => {
     return res.status(404).send("404 Not Found: User does not exist.");
   }
 
-  req.body.group = req.body.group === "admin" ? "admin" : "user";
+  if (!req.body.group) {
+    req.body.group = user.group;
+  } else {
+    req.body.group = req.body.group === "admin" ? "admin" : "user";
+  }
   // 当跨用户修改或添加管理员权限时，需要管理员权限。
   // 修改真实姓名和学号也需要管理员权限。
   if (!isAdmin) {