cwinfo/powerdns-admin
5
0
Fork 0
mirror of https://github.com/cwinfo/powerdns-admin.git synced 2025-01-07 10:55:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #273 from tmuncks/dont-revoke-your-own-rights

Browse Source 
Restrict certain admin changes on the current user
This commit is contained in:
Khanh Ngo 2018-06-07 08:48:44 +07:00 committed by GitHub
commit 2c5a98aca4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/templates/admin_manageuser.html
View File

@ -47,7 +47,7 @@
<td>{{ user.lastname }}</td> <td>{{ user.lastname }}</td>
<td>{{ user.email }}</td> <td>{{ user.email }}</td>
<td> <td>
<input type="checkbox" id="{{ user.username }}" class="admin_toggle" {% if user.role.name=='Administrator' %}checked{% endif %}> <input type="checkbox" id="{{ user.username }}" class="admin_toggle" {% if user.role.name=='Administrator' %}checked{% endif %} {% if user.username==current_user.username %}disabled{% endif %}>
</td> </td>
<td width="6%"> <td width="6%">
<button type="button" class="btn btn-flat btn-warning button_revoke" id="{{ user.username }}"> <button type="button" class="btn btn-flat btn-warning button_revoke" id="{{ user.username }}">
@ -55,7 +55,7 @@
</button> </button>
</td> </td>
<td width="6%"> <td width="6%">
<button type="button" class="btn btn-flat btn-danger button_delete" id="{{ user.username }}"> <button type="button" class="btn btn-flat btn-danger button_delete" id="{{ user.username }}" {% if user.username==current_user.username %}disabled{% endif %}>
Delete&nbsp;<i class="fa fa-trash"></i> Delete&nbsp;<i class="fa fa-trash"></i>
</button> </button>
</td> </td>

4
app/views.py
View File

@ -1098,6 +1098,8 @@ def admin_manageuser():
data = jdata['data'] data = jdata['data']
if jdata['action'] == 'delete_user': if jdata['action'] == 'delete_user':
if username == current_user.username:
return make_response(jsonify( { 'status': 'error', 'msg': 'You cannot delete yourself.' } ), 400)
user = User(username=data) user = User(username=data)
result = user.delete() result = user.delete()
if result: if result:
@ -1119,6 +1121,8 @@ def admin_manageuser():
elif jdata['action'] == 'set_admin': elif jdata['action'] == 'set_admin':
username = data['username'] username = data['username']
if username == current_user.username:
return make_response(jsonify( { 'status': 'error', 'msg': 'You cannot change you own admin rights.' } ), 400)
is_admin = data['is_admin'] is_admin = data['is_admin']
user = User(username=username) user = User(username=username)
result = user.set_admin(is_admin) result = user.set_admin(is_admin)