Commit d6573305 authored by Ozzieisaacs's avatar Ozzieisaacs

Fix for removing admin role from last admin user (in addition to prevent...

Fix for removing admin role from last admin user (in addition to prevent delete of last admin user) #1326
parent 36cb79de
...@@ -834,9 +834,8 @@ def edit_user(user_id): ...@@ -834,9 +834,8 @@ def edit_user(user_id):
if request.method == "POST": if request.method == "POST":
to_save = request.form.to_dict() to_save = request.form.to_dict()
if "delete" in to_save: if "delete" in to_save:
if ub.session.query(ub.User).filter(and_(ub.User.role.op('&') if ub.session.query(ub.User).filter(ub.User.role.op('&')(constants.ROLE_ADMIN) == constants.ROLE_ADMIN,
(constants.ROLE_ADMIN)== constants.ROLE_ADMIN, ub.User.id != content.id).count():
ub.User.id != content.id)).count():
ub.session.query(ub.User).filter(ub.User.id == content.id).delete() ub.session.query(ub.User).filter(ub.User.id == content.id).delete()
ub.session.commit() ub.session.commit()
flash(_(u"User '%(nick)s' deleted", nick=content.nickname), category="success") flash(_(u"User '%(nick)s' deleted", nick=content.nickname), category="success")
...@@ -845,6 +844,12 @@ def edit_user(user_id): ...@@ -845,6 +844,12 @@ def edit_user(user_id):
flash(_(u"No admin user remaining, can't delete user", nick=content.nickname), category="error") flash(_(u"No admin user remaining, can't delete user", nick=content.nickname), category="error")
return redirect(url_for('admin.admin')) return redirect(url_for('admin.admin'))
else: else:
if not ub.session.query(ub.User).filter(ub.User.role.op('&')(constants.ROLE_ADMIN) == constants.ROLE_ADMIN,
ub.User.id != content.id).count() and \
not 'admin_role' in to_save:
flash(_(u"No admin user remaining, can't remove admin role", nick=content.nickname), category="error")
return redirect(url_for('admin.admin'))
if "password" in to_save and to_save["password"]: if "password" in to_save and to_save["password"]:
content.password = generate_password_hash(to_save["password"]) content.password = generate_password_hash(to_save["password"])
anonymous = content.is_anonymous anonymous = content.is_anonymous
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment