From d65e5bb37b238bc85db749ff1d2d7dbd09908c3d Mon Sep 17 00:00:00 2001
From: Mink80 <46659983+Mink80@users.noreply.github.com>
Date: Sun, 16 Jul 2023 07:12:38 +0200
Subject: [PATCH] fix: Exclude higher privileged mobiles in AdminGump (#1423)

---------

Co-authored-by: Kamron Batman <3953314+kamronbatman@users.noreply.github.com>
---
 Projects/UOContent/Gumps/AdminGump.cs | 34 ++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/Projects/UOContent/Gumps/AdminGump.cs b/Projects/UOContent/Gumps/AdminGump.cs
index df1987292..10cc79e73 100644
--- a/Projects/UOContent/Gumps/AdminGump.cs
+++ b/Projects/UOContent/Gumps/AdminGump.cs
@@ -87,6 +87,8 @@ namespace Server.Gumps
             m_State = state;
             m_List = list;
 
+            FilterAccess(m_List, from);
+
             AddPage(0);
 
             AddBackground(0, 0, 420, 440, 5054);
@@ -434,6 +436,7 @@ namespace Server.Gumps
                             states.Sort(NetStateComparer.Instance);
 
                             m_List = states.ToList<object>();
+                            FilterAccess(m_List, from);
                         }
 
                         AddClientHeader();
@@ -528,6 +531,13 @@ namespace Server.Gumps
 
                         AddLabel(20, y, LabelHue, "Account:");
                         AddLabel(200, y, a?.Banned == true ? RedHue : LabelHue, a == null ? "(no account)" : a.Username);
+
+                        if (m.AccessLevel > from.AccessLevel || a?.AccessLevel > from.AccessLevel)
+                        {
+                            AddLabel(20, y + 20, LabelHue, "You do not have permission to view this client's information.");
+                            break;
+                        }
+
                         AddButton(380, y, 0xFA5, 0xFA7, GetButtonID(7, 14));
                         y += 20;
 
@@ -3768,7 +3778,8 @@ namespace Server.Gumps
                     }
                 case 7:
                     {
-                        if (m_State is not Mobile m)
+                        if (m_State is not Mobile m ||
+                            m.AccessLevel > from.AccessLevel || m.Account?.AccessLevel > from.AccessLevel)
                         {
                             break;
                         }
@@ -4123,6 +4134,27 @@ namespace Server.Gumps
             }
         }
 
+        private static void FilterAccess(List<object> list, Mobile from)
+        {
+            if (list == null || list.Count == 0)
+            {
+                return;
+            }
+
+            for (var i = list.Count - 1; i >= 0; i--)
+            {
+                var obj = list[i];
+
+                if (obj is Account acc && acc.AccessLevel > from.AccessLevel ||
+                    obj is Mobile mob && mob.AccessLevel > from.AccessLevel ||
+                    obj is NetState ns &&
+                    (ns.Mobile.AccessLevel > from.AccessLevel || ns.Account.AccessLevel > from.AccessLevel))
+                {
+                    list.RemoveAt(i);
+                }
+            }
+        }
+
         private class SharedAccountDescendingComparer : IComparer<object>
         {
             public static readonly IComparer<object> Instance = new SharedAccountDescendingComparer();