浏览代码

[useradmin] Prevent change of username

Password typing not required for editing a user profile
Romain Rigaux 12 年之前
父节点
当前提交
a664157

+ 6 - 0
apps/useradmin/src/useradmin/forms.py

@@ -52,6 +52,12 @@ class UserChangeForm(django.contrib.auth.forms.UserChangeForm):
                                             initial=True,
                                             required=False)
 
+  def __init__(self, *args, **kwargs):
+    super(UserChangeForm, self).__init__(*args, **kwargs)
+
+    if self.instance.id:
+      self.fields['username'].widget.attrs['readonly'] = True
+
   class Meta(django.contrib.auth.forms.UserChangeForm.Meta):
     fields = ["username", "first_name", "last_name", "email", "ensure_home_directory"]
 

+ 3 - 3
apps/useradmin/src/useradmin/templates/edit_user.mako

@@ -38,7 +38,7 @@ ${ commonheader(_('Hue Users'), "useradmin", user, "100px") | n,unicode }
       <div id="properties" class="section">
         <ul class="nav nav-tabs">
           <li class="active"><a href="#step1" class="step">${ _('Step 1: Credentials (required)') }</a></li>
-          <li><a href="#step2" class="step">${ _('Step 2: Names and Groups') }</a></li>
+          <li><a href="#step2" class="step">${ user.is_superuser and _('Step 2: Names and Groups') or _('Step 2: Names') }</a></li>
           % if user.is_superuser:
           <li><a href="#step3" class="step">${ _('Step 3: Advanced') }</a></li>
           % endif
@@ -48,8 +48,8 @@ ${ commonheader(_('Hue Users'), "useradmin", user, "100px") | n,unicode }
           <div id="step1" class="stepDetails">
             ${layout.render_field(form["username"], extra_attrs={'validate':'true'})}
             % if "password1" in form.fields:
-              ${layout.render_field(form["password1"], extra_attrs={'validate':'true'})}
-              ${layout.render_field(form["password2"], extra_attrs={'validate':'true'})}
+              ${layout.render_field(form["password1"], extra_attrs=username is None and {'validate':'true'} or {})}
+              ${layout.render_field(form["password2"], extra_attrs=username is None and {'validate':'true'} or {})}
             % endif
             ${layout.render_field(form["ensure_home_directory"])}
           </div>

+ 9 - 0
apps/useradmin/src/useradmin/tests.py

@@ -306,6 +306,15 @@ def test_user_admin():
                     follow=True)
   assert_true("User information updated" in response.content,
               "Notification should be displayed in: %s" % response.content)
+  # Edit it, can't change username
+  response = c.post('/useradmin/users/edit/test',
+                    dict(username="test2",
+                         first_name=u"Inglés",
+                         last_name=u"Español",
+                         is_superuser="True",
+                         is_active="True"),
+                    follow=True)
+  assert_true("You cannot change a username" in response.content)
   # Now make sure that those were materialized
   response = c.get('/useradmin/users/edit/test')
   assert_equal(smart_unicode("Inglés"), response.context["form"].instance.first_name)

+ 2 - 7
apps/useradmin/src/useradmin/views.py

@@ -149,15 +149,10 @@ def edit_user(request, username=None):
     if form.is_valid(): # All validation rules pass
       if instance is None:
         instance = form.save()
-        # Create profile for new users.
         get_profile(instance)
       else:
-        #
-        # Check for 3 more conditions:
-        # (1) A user cannot inactivate oneself;
-        # (2) Non-superuser cannot promote himself; and
-        # (3) The last active superuser cannot demote/inactivate himself.
-        #
+        if username != form.instance.username:
+          raise PopupException(_("You cannot change a username."), error_code=401)
         if request.user.username == username and not form.instance.is_active:
           raise PopupException(_("You cannot make yourself inactive."), error_code=401)