Move conn.updateAdminPrivileges() inside if block

Author: will-moore

components/tools/OmeroWeb/omeroweb/webadmin/views.py

@@ -588,16 +588,18 @@ def manage_experimenter(request, action, eid=None, conn=None, **kwargs):
 
                 # Update 'AdminPrivilege' config roles for user
                 privileges = conn.get_privileges_from_form(form)
-                # Only process privileges that we have permission to set
                 to_add = []
                 to_remove = []
                 if privileges is not None:
+                    # Only update privileges that we have permission to set
+                    # (prevents privilege escalation)
                     for p in conn.getCurrentAdminPrivileges():
                         if p in privileges:
                             to_add.append(p)
                         else:
                             to_remove.append(p)
-                conn.updateAdminPrivileges(experimenter.id, to_add, to_remove)
+                    conn.updateAdminPrivileges(experimenter.id,
+                                               to_add, to_remove)
 
                 conn.updateExperimenter(
                     experimenter, omename, firstName, lastName, email, admin,