	public function AdminObserver()
	{
		if($this->getPosted('go_back'))
		{
			$this->redirect('list', 'main', true);
		}
		
		$userid = $this->getId();
		$sql = e107::getDb();
		$user = e107::getUser();
		$sysuser = e107::getSystemUser($userid, false);
		$admin_log = e107::getAdminLog();
		$mes = e107::getMessage();
		
		if(!$user->checkAdminPerms('3'))
		{
			// TODO lan
			$mes->addError("You don't have enough permissions to do this.", 'default', true);
			// TODO lan
			$lan = 'Security violation (not enough permissions) - Administrator --ADMIN_UID-- (--ADMIN_NAME--, --ADMIN_EMAIL--) tried to make --UID-- (--NAME--, --EMAIL--) system admin';
			$search = array('--UID--', '--NAME--', '--EMAIL--', '--ADMIN_UID--', '--ADMIN_NAME--', '--ADMIN_EMAIL--');
			$replace = array($sysuser->getId(), $sysuser->getName(), $sysuser->getValue('email'), $user->getId(), $user->getName(), $user->getValue('email'));
			
			e107::getLog()->add('USET_08', str_replace($search, $replace, $lan), E_LOG_INFORMATIVE);
			
			$this->redirect('list', 'main', true);
		}
		
		if(!$sysuser->getId())
		{
			// TODO lan
			$mes->addError("User not found.", 'default', true);
			$this->redirect('list', 'main', true);
		}
		
		if(!$sysuser->isAdmin())
		{
			$sysuser->set('user_admin', 1)->save(); //"user","user_admin='1' WHERE user_id={$userid}"
			$lan = str_replace(array('--UID--', '--NAME--', '--EMAIL--'), array($sysuser->getId(), $sysuser->getName(), $sysuser->getValue('email')), USRLAN_164);
			e107::getLog()->add('USET_08', $lan, E_LOG_INFORMATIVE);
			$mes->addSuccess($lan);
		}
		
		if($this->getPosted('update_admin')) e107::getUserPerms()->updatePerms($userid, $_POST['perms']);
	}

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.