bugfix: set cameo flag only for admin user (clone user object)

server/src/handler/private.go

@@ -3,8 +3,9 @@ package handler
 import (
 	"fmt"
 	"net/http"
-	"sirlab.de/go/knowyt/user"
 	"strings"
+
+	"sirlab.de/go/knowyt/user"
 )
 
 func (authMux *AuthMux) PrivateHandleFunc(pattern string, handlerFunc PrivateHandlerFunc) {
@@ -43,7 +44,8 @@ func (authMux *AuthMux) getUserFromSession(r *http.Request) (*user.User, error)
 
 	if usr.IsAdmin() {
 		if cookieCameo, err := r.Cookie("knowyt-auth-cameo"); err == nil {
-			if usrNew, err := authMux.app.GetUserById(cookieCameo.Value); err == nil {
+			if usrCameo, err := authMux.app.GetUserById(cookieCameo.Value); err == nil {
+				usrNew := usrCameo.DeepCloneUserObj()
 				usrNew.SetCameo(usr)
 				return usrNew, nil
 			}

server/src/user/user.go

@@ -5,9 +5,10 @@ import (
 	"fmt"
 	"os"
 	"path"
-	"sirlab.de/go/knowyt/fileutil"
 	"strings"
 	"time"
+
+	"sirlab.de/go/knowyt/fileutil"
 )
 
 func NewUserFromFile(fileName string) (*User, error) {
@@ -48,6 +49,24 @@ func CreateUser(fileName, gameId string) *User {
 	}
 }
 
+func (usr *User) DeepCloneUserObj() *User {
+	usr.mu.Lock()
+	defer usr.mu.Unlock()
+
+	usrNew := User{
+		id:           usr.id,
+		filename:     usr.filename,
+		authcode:     usr.authcode,
+		name:         usr.name,
+		role:         usr.role,
+		gameId:       usr.gameId,
+		created:      usr.created,
+		lastLoggedIn: usr.lastLoggedIn,
+		cameo:        usr.cameo,
+	}
+	return &usrNew
+}
+
 func (usr *User) SaveUser() error {
 	usr.mu.Lock()
 	defer usr.mu.Unlock()