security: Do not allow user to give themselves admin or super_user privileges.

apps/accounts/api_views.py

@@ -285,6 +285,13 @@ class UserViewSet(viewsets.ModelViewSet):
     def me(self, request):
         user = request.user
         if request.method == "PATCH":
+            ALLOWED_FIELDS = {"custom_properties", "first_name", "last_name", "email", "password"}
+            disallowed = set(request.data.keys()) - ALLOWED_FIELDS
+            if disallowed:
+                return Response(
+                    {"detail": f"Fields not allowed for self-update: {', '.join(disallowed)}"},
+                    status=400,
+                )
             serializer = UserSerializer(user, data=request.data, partial=True)
             serializer.is_valid(raise_exception=True)
             serializer.save()