fix(ui): prevent administrators from editing their own account

The user edit page let administrators change their own password
without entering the current one, which bypassed the check on the
authentication page. Since changing a password signs out the other
sessions, someone with a stolen administrator session could also
lock the owner out of their account.

The users list already hides the logged-in user, so reject showing
or submitting the edit form for your own account. Usernames and
passwords are changed on the authentication page instead. Changing
another user's password now signs out all of that user's sessions.

internal/ui/user_edit.go

@@ -4,6 +4,7 @@
 package ui // import "miniflux.app/v2/internal/ui"
 
 import (
+	"errors"
 	"net/http"
 
 	"miniflux.app/v2/internal/http/request"
@@ -37,6 +38,12 @@ func (h *handler) showEditUserPage(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Users change their own username and password on the authentication page.
+	if selectedUser.ID == user.ID {
+		response.HTMLBadRequest(w, r, errors.New("you cannot edit yourself"))
+		return
+	}
+
 	userForm := &form.UserForm{
 		Username: selectedUser.Username,
 		IsAdmin:  selectedUser.IsAdmin,

internal/ui/user_update.go

@@ -4,6 +4,7 @@
 package ui // import "miniflux.app/v2/internal/ui"
 
 import (
+	"errors"
 	"net/http"
 
 	"miniflux.app/v2/internal/http/request"
@@ -37,6 +38,13 @@ func (h *handler) updateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Changing your own password must go through the authentication page,
+	// which asks for the current password.
+	if selectedUser.ID == loggedUser.ID {
+		response.HTMLBadRequest(w, r, errors.New("you cannot edit yourself"))
+		return
+	}
+
 	userForm := form.NewUserForm(r)
 
 	view := view.New(h.tpl, r)
@@ -67,8 +75,7 @@ func (h *handler) updateUser(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if userForm.Password != "" {
-		// Administrators editing their own account keep their current session.
-		if err := h.store.RemoveUserWebSessionsExcept(selectedUser.ID, request.WebSession(r).ID); err != nil {
+		if err := h.store.RemoveUserWebSessionsExcept(selectedUser.ID, ""); err != nil {
 			response.HTMLServerError(w, r, err)
 			return
 		}