05/24 Fix Security bugs

models.py

@@ -274,7 +274,25 @@ def update_user(admin_id, user_id, username, role, full_name, is_active, passwor
     conn = None
     try:
         conn = get_connection()
-        cur = conn.cursor()
+        cur = conn.cursor(dictionary=True)
+
+        # Guard: prevent demoting or deactivating the last active admin.
+        cur.execute("SELECT role FROM users WHERE id=%s", (user_id,))
+        target = cur.fetchone()
+        if target and target["role"] == "admin":
+            removing_admin = (role != "admin") or (not is_active)
+            if removing_admin:
+                cur.execute(
+                    "SELECT COUNT(*) AS n FROM users WHERE role='admin' AND is_active=1"
+                )
+                if cur.fetchone()["n"] <= 1:
+                    cur.close()
+                    raise ValueError(
+                        "Cannot demote or deactivate the last active administrator. "
+                        "Promote another user to admin first."
+                    )
+
+        cur = conn.cursor()   # switch back to plain cursor for the UPDATE
         if password:
             cur.execute(
                 "UPDATE users SET username=%s, role=%s, full_name=%s, is_active=%s, "