Bug 141557 - modification to user deletion code in editusers.cgi - prevent allowuserdeletion being bypassed. Patch by gerv; 2xr=myk.

1 files changed, 2 insertions, 0 deletions

diff --git a/editusers.cgi b/editusers.cgi
index ad124032e..06c293e2d 100755
--- a/editusers.cgi
+++ b/editusers.cgi
@@ -528,6 +528,7 @@ if ($action eq 'del') {
     if (!$candelete) {
         print "Sorry, deleting users isn't allowed.";
         PutTrailer();
+        exit;
     }
     if (!$editall) {
         print "Sorry, you don't have permissions to delete users.";
@@ -657,6 +658,7 @@ if ($action eq 'delete') {
     if (!$candelete) {
         print "Sorry, deleting users isn't allowed.";
         PutTrailer();
+        exit;
     }
     if (!$editall) {
         print "Sorry, you don't have permissions to delete users.";