fix(user-token): prevent admin read tokens of other admins EE-5858 (#10489)

api/http/handler/users/user_get_access_tokens.go

@@ -33,23 +33,23 @@ func (handler *Handler) userGetAccessTokens(w http.ResponseWriter, r *http.Reque
 		return httperror.BadRequest("Invalid user identifier route variable", err)
 	}
 
+	user, err := handler.DataStore.User().Read(portainer.UserID(userID))
+	if err != nil {
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
+		}
+		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+	}
+
 	tokenData, err := security.RetrieveTokenData(r)
 	if err != nil {
 		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
 	}
 
-	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+	if tokenData.ID != portainer.UserID(userID) && (tokenData.Role != portainer.AdministratorRole || user.Role == portainer.AdministratorRole) {
 		return httperror.Forbidden("Permission denied to get user access tokens", httperrors.ErrUnauthorized)
 	}
 
-	_, err = handler.DataStore.User().Read(portainer.UserID(userID))
-	if err != nil {
-		if handler.DataStore.IsErrObjectNotFound(err) {
-			return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
-		}
-		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
-	}
-
 	apiKeys, err := handler.apiKeyService.GetAPIKeys(portainer.UserID(userID))
 	if err != nil {
 		return httperror.InternalServerError("Internal Server Error", err)