Craft has a Permission Bypass and IDOR in Duplicate Entry Action

@@ -37,3 +37,4 @@
 - Fixed a bug where Table fields with the “Static Rows” setting enabled would lose track of which values belonged to which row headings, if the “Default Values” table was reordered. ([#17090](https://github.com/craftcms/cms/issues/17090))
 - Fixed a bug where deadlocks could occur when updating elements’ search indexes. ([#18139](https://github.com/craftcms/cms/pull/18139))
 - Fixed an RCE vulnerability. (GHSA-v47q-jxvr-p68x)
+- Fixed a permission escalation vulnerability. (GHSA-jxm3-pmm2-9gf6)

@@ -78,14 +78,14 @@ public function getTriggerHtml(): ?string
         }
 
         Craft::$app->getView()->registerJsWithVars(
-            fn($type, $undeletableIds, $redirect) => <<<JS
+            fn($type, $redirect) => <<<JS
 (() => {
     new Craft.ElementActionTrigger({
         type: $type,
         bulk: true,
         validateSelection: \$selectedItems => {
             for (let i = 0; i < \$selectedItems.length; i++) {
-                if ($.inArray(\$selectedItems.eq(i).find('.element').data('id').toString(), $undeletableIds) != -1) {
+                if (!Garnish.hasAttr(\$selectedItems.eq(i).find('.element'), 'data-deletable')) {
                     return false;
                 }
             }
@@ -116,7 +116,6 @@ public function getTriggerHtml(): ?string
 JS,
             [
                 static::class,
-                $this->_getUndeletableUserIds(),
                 Craft::$app->getSecurity()->hashData(Craft::$app->getEdition() === Craft::Pro ? 'users' : 'dashboard'),
             ]);
 
@@ -144,7 +143,6 @@ public function performAction(ElementQueryInterface $query): bool
     {
         /** @var User[] $users */
         $users = $query->all();
-        $undeletableIds = $this->_getUndeletableUserIds();
 
         // Are we transferring the user’s content to a different user?
         if (is_array($this->transferContentTo)) {
@@ -163,9 +161,11 @@ public function performAction(ElementQueryInterface $query): bool
 
         // Delete the users
         $elementsService = Craft::$app->getElements();
+        $currentUser = Craft::$app->getUser()->getIdentity();
         $deletedCount = 0;
+
         foreach ($users as $user) {
-            if (!in_array($user->id, $undeletableIds, false)) {
+            if ($elementsService->canDelete($user, $currentUser)) {
                 $user->inheritorOnDelete = $transferContentTo;
                 if ($elementsService->deleteElement($user, $this->hard)) {
                     $deletedCount++;
@@ -193,20 +193,4 @@ public function performAction(ElementQueryInterface $query): bool
 
         return true;
     }
-
-    /**
-     * Returns a list of the user IDs that can't be deleted.
-     *
-     * @return array
-     */
-    private function _getUndeletableUserIds(): array
-    {
-        if (!Craft::$app->getUser()->getIsAdmin()) {
-            // Only admins can delete other admins
-            return User::find()->admin()->ids();
-        }
-
-        // Can't delete your own account from here
-        return [Craft::$app->getUser()->getIdentity()->id];
-    }
 }

@@ -109,8 +109,13 @@ private function _duplicateElements(ElementQueryInterface $query, array $element
     {
         $elementsService = Craft::$app->getElements();
         $structuresService = Craft::$app->getStructures();
+        $user = Craft::$app->getUser()->getIdentity();
 
         foreach ($elements as $element) {
+            if (!$elementsService->canDuplicate($element, $user)) {
+                continue;
+            }
+
             // Make sure this element wasn't already duplicated, which could
             // happen if it's the descendant of a previously duplicated element
             // and $this->deep == true.

@@ -79,24 +79,25 @@ public function getTriggerLabel(): string
      */
     public function getTriggerHtml(): ?string
     {
-        if ($this->restorableElementsOnly) {
-            // Only enable for deletable elements, per canDelete()
-            Craft::$app->getView()->registerJsWithVars(fn($type) => <<<JS
+        // Only enable for restorable/savable elements
+        Craft::$app->getView()->registerJsWithVars(fn($type, $attribute) => <<<JS
 (() => {
     new Craft.ElementActionTrigger({
         type: $type,
         validateSelection: \$selectedItems => {
             for (let i = 0; i < \$selectedItems.length; i++) {
-                if (!Garnish.hasAttr(\$selectedItems.eq(i).find('.element'), 'data-restorable')) {
+                if (!Garnish.hasAttr(\$selectedItems.eq(i).find('.element'), $attribute)) {
                     return false;
                 }
             }
             return true;
         },
     });
 })();
-JS, [static::class]);
-        }
+JS, [
+            static::class,
+            $this->restorableElementsOnly ? 'data-restorable' : 'data-savable',
+        ]);
 
         return '<div class="btn formsubmit">' . $this->getTriggerLabel() . '</div>';
     }
@@ -109,7 +110,13 @@ public function performAction(ElementQueryInterface $query): bool
         $anySuccess = false;
         $anyFail = false;
         $elementsService = Craft::$app->getElements();
+        $user = Craft::$app->getUser()->getIdentity();
+
         foreach ($query->all() as $element) {
+            if (!$elementsService->canSave($element, $user)) {
+                continue;
+            }
+
             if ($elementsService->restoreElement($element)) {
                 $anySuccess = true;
             } else {

@@ -85,21 +85,16 @@ public function performAction(ElementQueryInterface $query): bool
         $elementType = $this->elementType;
         $isLocalized = $elementType::isLocalized() && Craft::$app->getIsMultiSite();
         $elementsService = Craft::$app->getElements();
+        $user = Craft::$app->getUser()->getIdentity();
 
         $elements = $query->all();
         $failCount = 0;
 
-        // Make sure the user has permission to edit each of the elements
         foreach ($elements as $element) {
-            if (!$elementsService->canSave($element)) {
-                $this->setMessage(Craft::t('app', 'Couldn’t save {type}.', [
-                    'type' => count($elements) === 1 ? $elementType::lowerDisplayName() : $elementType::pluralLowerDisplayName(),
-                ]));
-                return false;
+            if (!$elementsService->canSave($element, $user)) {
+                continue;
             }
-        }
 
-        foreach ($elements as $element) {
             switch ($this->status) {
                 case self::ENABLED:
                     // Skip if there's nothing to change

@@ -3155,7 +3155,7 @@ protected function htmlAttributes(string $context): array
             $attributes['data']['editable-image'] = true;
         }
 
-        if ($this->dateDeleted && $this->keptFile) {
+        if ($this->dateDeleted && $this->keptFile && Craft::$app->getElements()->canSave($this)) {
             $attributes['data']['restorable'] = true;
         }
 

@@ -1435,7 +1435,8 @@ public function canDelete(User $user): bool
 
         return (
             $user->id !== $this->id &&
-            $user->can('deleteUsers')
+            $user->can('deleteUsers') &&
+            (!$this->admin || $user->admin)
         );
     }