From: Tomas Sedovic <tsedovic(a)redhat.com>
https://bugzilla.redhat.com/show_bug.cgi?id=674564
The Administrator user was able to delete its own account. This could lock
everyone up (if this was the only admin).
---
src/app/controllers/admin/users_controller.rb | 14 +++++++++++++-
src/features/step_definitions/user_steps.rb | 7 ++++++-
src/features/user.feature | 16 +++++++++++++++-
src/spec/factories/user.rb | 1 +
4 files changed, 35 insertions(+), 3 deletions(-)
diff --git a/src/app/controllers/admin/users_controller.rb
b/src/app/controllers/admin/users_controller.rb
index 6134cd3..d0297ad 100644
--- a/src/app/controllers/admin/users_controller.rb
+++ b/src/app/controllers/admin/users_controller.rb
@@ -90,7 +90,19 @@ class Admin::UsersController < ApplicationController
def multi_destroy
require_privilege(Privilege::MODIFY, User)
- User.destroy(params[:user_selected])
+ deleted_users = []
+ User.find(params[:user_selected]).each do |user|
+ if user == current_user
+ flash[:warning] = "Cannot delete #{user.login}: you are logged in as this
user"
+ else
+ user.destroy
+ deleted_users << user.login
+ end
+ end
+ unless deleted_users.empty?
+ msg = "Deleted user#{'s' if deleted_users.length > 1}"
+ flash[:notice] = "#{msg}: #{deleted_users.join(', ')}"
+ end
redirect_to admin_users_url
end
diff --git a/src/features/step_definitions/user_steps.rb
b/src/features/step_definitions/user_steps.rb
index 13932fa..c82566f 100644
--- a/src/features/step_definitions/user_steps.rb
+++ b/src/features/step_definitions/user_steps.rb
@@ -8,6 +8,11 @@ Given /^there are (\d+) users$/ do |number|
User.count.should == number.to_i
end
-Then /^there should only be (\d+) users$/ do |number|
+Then /^there should be (\d+) users?$/ do |number|
User.count.should == number.to_i
end
+
+When /^(?:|I )check "([^"]*)" user$/ do |user_name|
+ user = User.find_by_login(user_name)
+ check("user_checkbox_#{user.id}")
+end
diff --git a/src/features/user.feature b/src/features/user.feature
index 34559c7..b073436 100644
--- a/src/features/user.feature
+++ b/src/features/user.feature
@@ -39,9 +39,23 @@ Feature: Manage Users
When I follow "create"
Then I should be on the new admin user page
When I follow "cancel"
- Then there should only be 2 users
+ Then there should be 2 users
And I should be on the admin users page
+ Scenario: Delete users
+ Given there is a user "testuser"
+ And I am on the admin users page
+ Then there should be 2 users
+ When I check "admin" user
+ And I press "Delete"
+ Then I should see "Cannot delete admin"
+ And there should be 2 users
+ And I should be on the admin users page
+ When I check "testuser" user
+ And I press "Delete"
+ Then I should see "Deleted user"
+ And there should be 1 user
+
Scenario: Search for hardware profiles
Given there is a user "myuser"
And there is a user "someuser"
diff --git a/src/spec/factories/user.rb b/src/spec/factories/user.rb
index 21eae00..3783284 100644
--- a/src/spec/factories/user.rb
+++ b/src/spec/factories/user.rb
@@ -17,6 +17,7 @@ Factory.define :tuser, :parent => :user do |u|
end
Factory.define :admin_user, :parent => :user do |u|
+ u.login 'admin'
end
Factory.define :pool_creator_user, :parent => :user do |u|
--
1.7.4