IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2025-02-25 18:55:24 -06:00
Code Issues Packages Projects Releases Wiki Activity

Check whether self-deactivation is enabled in delete handler (#10300)

Browse Source
This commit is contained in:
Daniel Schalla
2019-02-20 16:56:26 +01:00
committed by GitHub
parent f046163a12
commit 166ab15f38
2 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
api4/user.go
View File

@@ -791,6 +791,12 @@ func deleteUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// if EnableUserDeactivation flag is disabled the user cannot deactivate himself.
if c.Params.UserId == c.App.Session.UserId && !*c.App.Config().TeamSettings.EnableUserDeactivation && !c.App.SessionHasPermissionTo(c.App.Session, model.PERMISSION_MANAGE_SYSTEM) {
c.Err = model.NewAppError("deleteUser", "api.user.update_active.not_enable.app_error", nil, "userId="+c.Params.UserId, http.StatusUnauthorized)
return
}
user, err := c.App.GetUser(userId)
if err != nil {
c.Err = err

15
api4/user_test.go
View File

@@ -1300,6 +1300,21 @@ func TestDeleteUser(t *testing.T) {
_, resp = th.Client.DeleteUser(testUser.Id)
CheckNoError(t, resp)
selfDeleteUser := th.CreateUser()
th.Client.Login(selfDeleteUser.Email, selfDeleteUser.Password)
th.App.UpdateConfig(func(c *model.Config){
*c.TeamSettings.EnableUserDeactivation = false
})
_, resp = th.Client.DeleteUser(selfDeleteUser.Id)
CheckUnauthorizedStatus(t, resp)
th.App.UpdateConfig(func(c *model.Config){
*c.TeamSettings.EnableUserDeactivation = true
})
_, resp = th.Client.DeleteUser(selfDeleteUser.Id)
CheckNoError(t, resp)
}
func TestUpdateUserRoles(t *testing.T) {