mirror of
https://github.com/Part-DB/Part-DB-server.git
synced 2025-06-21 01:25:55 +02:00
Forbid a user to delete himself on the admin page
This commit is contained in:
parent
9fd3012c27
commit
388d26fa05
2 changed files with 8 additions and 2 deletions
|
@ -169,8 +169,14 @@ class UserController extends BaseAdminController
|
||||||
#[Route(path: '/{id}', name: 'user_delete', methods: ['DELETE'], requirements: ['id' => '\d+'])]
|
#[Route(path: '/{id}', name: 'user_delete', methods: ['DELETE'], requirements: ['id' => '\d+'])]
|
||||||
public function delete(Request $request, User $entity, StructuralElementRecursionHelper $recursionHelper): RedirectResponse
|
public function delete(Request $request, User $entity, StructuralElementRecursionHelper $recursionHelper): RedirectResponse
|
||||||
{
|
{
|
||||||
|
//Disallow deleting the anonymous user
|
||||||
if (User::ID_ANONYMOUS === $entity->getID()) {
|
if (User::ID_ANONYMOUS === $entity->getID()) {
|
||||||
throw new InvalidArgumentException('You can not delete the anonymous user! It is needed for permission checking without a logged in user');
|
throw new \LogicException('You can not delete the anonymous user! It is needed for permission checking without a logged in user');
|
||||||
|
}
|
||||||
|
|
||||||
|
//Disallow deleting the current logged-in user
|
||||||
|
if ($entity === $this->getUser()) {
|
||||||
|
throw new \LogicException('You can not delete your own user account!');
|
||||||
}
|
}
|
||||||
|
|
||||||
return $this->_delete($request, $entity, $recursionHelper);
|
return $this->_delete($request, $entity, $recursionHelper);
|
||||||
|
|
|
@ -6,7 +6,7 @@
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<div class=""></div>
|
<div class=""></div>
|
||||||
<div class="col-sm offset-sm-3 ps-2">
|
<div class="col-sm offset-sm-3 ps-2">
|
||||||
{% set delete_disabled = (not is_granted("delete", entity)) or (entity.group is defined and entity.id == 1) %}
|
{% set delete_disabled = (not is_granted("delete", entity)) or (entity.group is defined and entity.id == 1) or entity == app.user %}
|
||||||
<div class="btn-group">
|
<div class="btn-group">
|
||||||
<button class="btn btn-danger" {% if delete_disabled %}disabled{% endif %}>{% trans %}entity.delete{% endtrans %}</button>
|
<button class="btn btn-danger" {% if delete_disabled %}disabled{% endif %}>{% trans %}entity.delete{% endtrans %}</button>
|
||||||
<button type="button" class="btn btn-danger dropdown-toggle dropdown-toggle-split" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
|
<button type="button" class="btn btn-danger dropdown-toggle dropdown-toggle-split" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue