From ba12e1b3a4a8032cb7fce849ad07ba8177da1644 Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Sat, 28 Jun 2025 11:00:51 +0900
Subject: [PATCH] Disable unsafe selections when the default value for a grant
 is manager

---
 modules/module/module.admin.model.php | 3 +++
 modules/module/tpl/module_grants.html | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/modules/module/module.admin.model.php b/modules/module/module.admin.model.php
index 0be94b122..a74fd0ea7 100644
--- a/modules/module/module.admin.model.php
+++ b/modules/module/module.admin.model.php
@@ -174,11 +174,13 @@ class ModuleAdminModel extends Module
 
 		// Get a permission group granted to the current module
 		$selected_group = array();
+		$default_xml_grant = array();
 		$default_grant = array();
 		foreach ($grant_list as $key => $val)
 		{
 			if (!empty($val->default))
 			{
+				$default_xml_grant[$key] = $val->default;
 				$default_grant[$key] = $val->default;
 			}
 		}
@@ -203,6 +205,7 @@ class ModuleAdminModel extends Module
 			}
 		}
 		Context::set('selected_group', $selected_group);
+		Context::set('default_xml_grant', $default_xml_grant);
 		Context::set('default_grant', $default_grant);
 		Context::set('module_srl', $module_srl);
 		// Extract admin ID set in the current module
diff --git a/modules/module/tpl/module_grants.html b/modules/module/tpl/module_grants.html
index dc4557465..b4da47c59 100644
--- a/modules/module/tpl/module_grants.html
+++ b/modules/module/tpl/module_grants.html
@@ -58,9 +58,11 @@
 				<label for="{$grant_name}_default" class="x_control-label">{$grant_item->title}</label>
 				<div class="x_controls">
 					<select name="{$grant_name}_default" id="{$grant_name}_default" class="grant_default">
+						<!--@if($default_xml_grant[$grant_name] !== 'manager')-->
 						<option value="0" <!--@if(($default_grant[$grant_name] ?? '') == 'all')-->selected="selected"<!--@end-->>{$lang->grant_to_all}</option>
 						<option value="-1" <!--@if(($default_grant[$grant_name] ?? '') == 'member' || ($default_grant[$grant_name] ?? '') == 'site')-->selected="selected"<!--@end-->>{$lang->grant_to_login_user}</option>
 						<option value="-4" <!--@if(($default_grant[$grant_name] ?? '') == 'not_member')-->selected="selected"<!--@end-->>{$lang->grant_to_non_login_user}</option>
+						<!--@endif-->
 						<option value="-3" <!--@if(($default_grant[$grant_name] ?? '') == 'manager')-->selected="selected"<!--@end-->>{$lang->grant_to_admin}</option>
 						<option value="" <!--@if(($default_grant[$grant_name] ?? '') == 'group')-->selected="selected"<!--@end-->>{$lang->grant_to_group}</option>
 					</select>