Prevent adding sub groups for ranks the granting player doesn't have access to.

2 files changed, 9 insertions, 0 deletions

diff --git a/EssentialsGroupManager/src/Changelog.txt b/EssentialsGroupManager/src/Changelog.txt
index fcdd930f0..d30265810 100644
--- a/EssentialsGroupManager/src/Changelog.txt
+++ b/EssentialsGroupManager/src/Changelog.txt
@@ -222,3 +222,4 @@ v 2.0:
 	- Store worldSelection indexed on the senders name rather than the object (fixes commandblocks using manselect).

 	- Check subgroup permissions with an equal priority so no one subgroup is higher ranked than another.

 	- add recursive permission adding/deleting
+	- Prevent adding sub groups for ranks the granting player doesn't have access to.
\ No newline at end of file
diff --git a/EssentialsGroupManager/src/org/anjocaido/groupmanager/GroupManager.java b/EssentialsGroupManager/src/org/anjocaido/groupmanager/GroupManager.java
index 3931991f7..5bef35abf 100644
--- a/EssentialsGroupManager/src/org/anjocaido/groupmanager/GroupManager.java
+++ b/EssentialsGroupManager/src/org/anjocaido/groupmanager/GroupManager.java
@@ -611,6 +611,14 @@ public class GroupManager extends JavaPlugin {
 					sender.sendMessage(ChatColor.RED + "You can't modify a player with same permissions as you, or higher.");
 					return true;
 				}
+				if (!isConsole && !isOpOverride && (permissionHandler.hasGroupInInheritance(auxGroup, senderGroup.getName()))) {
+					sender.sendMessage(ChatColor.RED + "The sub-group can't be the same as yours, or higher.");
+					return true;
+				}
+				if (!isConsole && !isOpOverride && (!permissionHandler.inGroup(senderUser.getName(), auxUser.getGroupName()) || !permissionHandler.inGroup(senderUser.getName(), auxGroup.getName()))) {
+					sender.sendMessage(ChatColor.RED + "You can't modify a player involving a group that you don't inherit.");
+					return true;
+				}
 				// Seems OK
 				if (auxUser.addSubGroup(auxGroup))
 					sender.sendMessage(ChatColor.YELLOW + "You added subgroup '" + auxGroup.getName() + "' to player '" + auxUser.getName() + "'.");