| @@ -152,12 +152,18 @@ | ||
| 152 | 152 | ); |
| 153 | 153 | |
| 154 | 154 | Acl::verify('fluentform_manage_entries', $formId); |
| 155 | 155 | $search = sanitize_text_field($app->request->get('search')); |
| 156 | - $users = get_users([ | |
| 157 | - 'search' => "*{$search}*", | |
| 158 | - 'number' => 50, | |
| 159 | - ]); | |
| 156 | + if (current_user_can('list_users')) { | |
| 157 | + $users = get_users([ | |
| 158 | + 'search' => "*{$search}*", | |
| 159 | + 'number' => 50, | |
| 160 | + ]); | |
| 161 | + } else { | |
| 162 | + // Non-admins confirm an exact email only, never browse the roster (FF-SEC-45). | |
| 163 | + $user = is_email($search) ? get_user_by('email', $search) : false; | |
| 164 | + $users = $user ? [$user] : []; | |
| 165 | + } | |
| 160 | 166 | $formattedUsers = []; |
| 161 | 167 | foreach ($users as $user) { |
| 162 | 168 | $formattedUsers[] = [ |
| 163 | 169 | 'ID' => $user->ID, |
