*/
@Override
protected void checkAccessRights(HttpServletRequest req, Group group, User entry) {
Group webUserGroup = webUser.getGroup();
if (!req.isUserInRole(UserManagerBase.ADMINISTRATOR) && group != webUserGroup){
throw new InputException(getResources(req).getMessage(locale, "um.insufficientRights"));
}
if (entry != null){
if (!req.isUserInRole(UserManagerBase.GROUP_ADMINISTRATOR) && entry.getId() != webUser.getId()) {
throw new InputException(getResources(req).getMessage(locale, "um.insufficientRights"));
}
// edited user may not have/receive more roles than the web user
for (Role role : entry.getRoles()) {
if (!req.isUserInRole(role.getRolename())){
throw new InputException(getResources(req).getMessage(locale, "um.insufficientRights"));
}
}
}
}