Upgrade to 3.2.1

kirby/src/Cms/UserRules.php

@@ -70,6 +70,13 @@ class UserRules
 
     public static function changeRole(User $user, string $role): bool
     {
+        if ($user->kirby()->user()->isAdmin() === false) {
+            throw new PermissionException([
+                'key'  => 'user.changeRole.permission',
+                'data' => ['name' => $user->username()]
+            ]);
+        }
+
         static::validRole($user, $role);
 
         if ($role !== 'admin' && $user->isLastAdmin() === true) {
@@ -95,6 +102,15 @@ class UserRules
         static::validEmail($user, $user->email(), true);
         static::validLanguage($user, $user->language());
 
+        // only admins are allowed to add admins
+        $role = $props['role'] ?? null;
+
+        if ($role === 'admin' && $user->kirby()->user()->isAdmin() === false) {
+            throw new PermissionException([
+                'key' => 'user.create.permission'
+            ]);
+        }
+
         if (empty($props['password']) === false) {
             static::validPassword($user, $props['password']);
         }