only admins can change rightslevel

pandora/user/views.py

@@ -362,7 +362,7 @@ def editUser(request, data):
             response = json_response(status=403, text='email already in use')
             return render_to_json_response(response)
         user.email = data['email']
-    if 'level' in data:
+    if 'level' in data and request.user.profile.get_level() == 'admin':
         profile.set_level(data['level'])
     if 'notes' in data:
         profile.notes = data['notes']

static/js/usersDialog.js

@@ -680,7 +680,8 @@ pandora.ui.usersDialog = function() {
 
                         }
                     }),
-                Ox.Select({
+                pandora.user.level == 'admin'
+                    ? Ox.Select({
                         id: 'level',
                         items: pandora.site.userLevels.slice(1).map(function(level) {
                             return {
@@ -692,6 +693,13 @@ pandora.ui.usersDialog = function() {
                         labelWidth: 80,
                         value: user.level,
                         width: formWidth - 16
+                    }) : Ox.Input({
+                        disabled: true,
+                        id: 'level',
+                        label: Ox._('Level'),
+                        labelWidth: 80,
+                        value: Ox.toTitleCase(user.level),
+                        width: formWidth - 16
                     }),
                 Ox.Checkbox({
                         id: 'newsletter',