From 0c0d89c1a6092631f1258d2a3c38db6049fa3ec9 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Wed, 4 Oct 2023 23:00:46 -0400
Subject: [PATCH] do not allow user logged in to edit their own user by
 clicking on their avatar under users

---
 users.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/users.php b/users.php
index 8f552569..e7435a8d 100644
--- a/users.php
+++ b/users.php
@@ -123,7 +123,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     ?>
                     <tr>
                         <td class="text-center">
-                            <a class="text-dark" href="#" data-toggle="modal" data-target="#editUserModal<?php echo $user_id; ?>">
+                            <a class="text-dark" href="#" <?php if ($user_id !== $session_user_id) {   // Prevent modifying self ?> data-toggle="modal" data-target="#editUserModal<?php echo $user_id; ?>" <?php } ?>>
                                 <?php if (!empty($user_avatar)) { ?>
                                     <img class="img-size-50 img-circle" src="<?php echo "uploads/users/$user_id/$user_avatar"; ?>">
                                 <?php } else { ?>