[PATCH aggregator] BZ#641386 Prevent currently logged in user deleting themself

[Martyn Taylor]

From: martyntaylor <mtaylor(a)redhat.com&gt;

---
 src/app/controllers/users_controller.rb |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/src/app/controllers/users_controller.rb
b/src/app/controllers/users_controller.rb
index 7047517..ebe0e8a 100644
--- a/src/app/controllers/users_controller.rb
+++ b/src/app/controllers/users_controller.rb
@@ -140,7 +140,9 @@ class UsersController < ApplicationController
     if @current_user.permissions.collect { |p| p.role }.find { |r| r.name ==
"Administrator" }
       if request.post? || request.delete?
         @user = User.find(params[:id])
-        if @user.destroy
+        if @user == @current_user
+          flash[:notice] = "Can not delete the currently logged in user!"
+        elsif @user.destroy
           flash[:notice] = "User Deleted"
         else
           flash[:error] = {
-- 
1.7.2.3

[Scott Seago]

mtaylor(a)redhat.com wrote:
>  From: martyntaylor <mtaylor(a)redhat.com&gt;
>
>  ---
>   src/app/controllers/users_controller.rb |    4 +++-
>   1 files changed, 3 insertions(+), 1 deletions(-)
>
>  diff --git a/src/app/controllers/users_controller.rb
> b/src/app/controllers/users_controller.rb
>  index 7047517..ebe0e8a 100644
>  --- a/src/app/controllers/users_controller.rb
>  +++ b/src/app/controllers/users_controller.rb
>  @@ -140,7 +140,9 @@ class UsersController < ApplicationController
>       if @current_user.permissions.collect { |p| p.role }.find { |r| r.name ==
> "Administrator" }
>         if request.post? || request.delete?
>           @user = User.find(params[:id])
>  -        if @user.destroy
>  +        if @user == @current_user
>  +          flash[:notice] = "Can not delete the currently logged in user!"
>  +        elsif @user.destroy
>             flash[:notice] = "User Deleted"
>           else
>             flash[:error] = {
>     
ACK

Scott