Fixed #1553

src/Ombi/Controllers/IdentityController.cs

@@ -221,6 +221,10 @@ namespace Ombi.Controllers
             {
                 return Error($"The email address {user.EmailAddress} is not a valid format");
             }
+            if (!CanModifyUser(user.Claims.Select(x => x.Value)))
+            {
+                return Error("You do not have the correct permissions to create this user");
+            }
             var ombiUser = new OmbiUser
             {
                 Alias = user.Alias,
@@ -261,6 +265,19 @@ namespace Ombi.Controllers
             };
         }
 
+        private bool CanModifyUser(IEnumerable<string> roles)
+        {
+            if (roles.Any(x => x.Equals("admin", StringComparison.CurrentCultureIgnoreCase)))
+            {
+                // Only Admins can create admins
+                if (!User.IsInRole(OmbiRoles.Admin))
+                {
+                    return false;
+                }
+            }
+            return true;
+        }
+
         /// <summary>
         /// This is for the local user to change their details.
         /// </summary>
@@ -346,6 +363,10 @@ namespace Ombi.Controllers
             {
                 return Error($"The email address {ui.EmailAddress} is not a valid format");
             }
+            if (!CanModifyUser(ui.Claims.Select(x => x.Value)))
+            {
+                return Error("You do not have the correct permissions to create this user");
+            }
             // Get the user
             var user = await UserManager.Users.FirstOrDefaultAsync(x => x.Id == ui.Id);
             user.Alias = ui.Alias;
@@ -398,10 +419,16 @@ namespace Ombi.Controllers
         [PowerUser]
         public async Task<OmbiIdentityResult> DeleteUser(string userId)
         {
-
             var userToDelete = await UserManager.Users.FirstOrDefaultAsync(x => x.Id == userId);
             if (userToDelete != null)
             {
+
+                // Can we delete this user?
+                var userRoles = await UserManager.GetRolesAsync(userToDelete);
+                if (!CanModifyUser(userRoles))
+                {
+                    return Error("You do not have the correct permissions to delete this user");
+                }
                 var result = await UserManager.DeleteAsync(userToDelete);
                 if (result.Succeeded)
                 {