Description

(Note: This is a apparently a known problem, but there's no issue for it we could find.)

When upgrading a room the user doing the upgrade gets promoted to admin in the old and new room.

Steps to reproduce

• create a new room
• invite user X
• grant moderator permissions to user X
• user X upgrades the room
• user X is now admin in the old and new room

I'd have expected that either the room upgrade is only allowed for admin users (if that's a technical requirement) or that the result of the upgrade is the same as before the upgrade (the user doing the upgrade is still moderator in both the old and the new rooms)

The default PL requirement for upgrading a room is 50 (moderator). This effectively makes this a potential privilege escalation bug if you don't change the default settings before promoting someone to moderator level.

Version information

• Version: 1.7.3