protected function _getUserRights()
    {
        // previously user had no rights defined
        if (!$this->oxuser__oxrights instanceof \OxidEsales\Eshop\Core\Field || !$this->oxuser__oxrights->value) {
            return 'user';
        }

        $oDb = \OxidEsales\Eshop\Core\DatabaseProvider::getDb();
        $myConfig = \OxidEsales\Eshop\Core\Registry::getConfig();
        $sAuthRights = null;

        // choosing possible user rights index
        $sAuthUserID = $this->isAdmin() ? Registry::getSession()->getVariable('auth') : null;
        $sAuthUserID = $sAuthUserID ? $sAuthUserID : Registry::getSession()->getVariable('usr');
        if ($sAuthUserID) {
            $sAuthRights = $oDb->getOne('select oxrights from ' . $this->getViewName() . ' where oxid=' . $oDb->quote($sAuthUserID));
        }

        //preventing user rights edit for non admin
        $aRights = [];

        // selecting current users rights ...
        if ($sCurrRights = $oDb->getOne('select oxrights from ' . $this->getViewName() . ' where oxid=' . $oDb->quote($this->getId()))) {
            $aRights[] = $sCurrRights;
        }
        $aRights[] = 'user';

        if (!$sAuthRights || !($sAuthRights == 'malladmin' || $sAuthRights == $myConfig->getShopId())) {
            return current($aRights);
        } elseif ($sAuthRights == $myConfig->getShopId()) {
            $aRights[] = $sAuthRights;
            if (!in_array($this->oxuser__oxrights->value, $aRights)) {
                return current($aRights);
            }
        }

        // leaving as it was set ...
        return $this->oxuser__oxrights->value;
    }