浏览代码

HUE-334. superuser can be deleted

bc Wong 15 年之前
父节点
当前提交
cd5d401be9
共有 2 个文件被更改,包括 42 次插入20 次删除
  1. 11 1
      apps/useradmin/src/useradmin/tests.py
  2. 31 19
      apps/useradmin/src/useradmin/views.py

+ 11 - 1
apps/useradmin/src/useradmin/tests.py

@@ -42,7 +42,12 @@ def test_user_admin():
   # Just check that this comes back
   # Just check that this comes back
   response = c.get('/useradmin/edit/test')
   response = c.get('/useradmin/edit/test')
   # Edit it, to add a first and last name
   # Edit it, to add a first and last name
-  response = c.post('/useradmin/edit/test', dict(username="test", first_name="Tom", last_name="Tester", is_superuser="True", is_active="True"))
+  response = c.post('/useradmin/edit/test',
+                    dict(username="test",
+                         first_name="Tom",
+                         last_name="Tester",
+                         is_superuser="True",
+                         is_active="True"))
   # Now make sure that those were materialized
   # Now make sure that those were materialized
   response = c.get('/useradmin/edit/test')
   response = c.get('/useradmin/edit/test')
   assert_equal("Tom", response.context["form"].instance.first_name)
   assert_equal("Tom", response.context["form"].instance.first_name)
@@ -53,6 +58,11 @@ def test_user_admin():
                         is_superuser=False, is_active=True))
                         is_superuser=False, is_active=True))
   assert_true("You cannot remove" in response.content,
   assert_true("You cannot remove" in response.content,
               "Shouldn't be able to remove the last superuser")
               "Shouldn't be able to remove the last superuser")
+  # Shouldn't be able to delete the last superuser
+  response = c.post('/useradmin/delete/test', {})
+  assert_true("You cannot remove" in response.content,
+              "Shouldn't be able to delete the last superuser")
+
   # Let's try changing the password
   # Let's try changing the password
   response = c.post('/useradmin/edit/test', dict(username="test", first_name="Tom", last_name="Tester", is_superuser=True, password1="foo", password2="foobar"))
   response = c.post('/useradmin/edit/test', dict(username="test", first_name="Tom", last_name="Tester", is_superuser=True, password1="foo", password2="foobar"))
   assert_equal(["Passwords do not match."], response.context["form"]["password2"].errors, "Should have complained about mismatched password")
   assert_equal(["Passwords do not match."], response.context["form"]["password2"].errors, "Should have complained about mismatched password")

+ 31 - 19
apps/useradmin/src/useradmin/views.py

@@ -22,11 +22,9 @@ import django
 import threading
 import threading
 from django import forms
 from django import forms
 from django.contrib.auth.models import User
 from django.contrib.auth.models import User
-from desktop.lib.django_util import render, MessageException
+from desktop.lib.django_util import render, PopupException
 from django.core import urlresolvers
 from django.core import urlresolvers
 
 
-# from desktop.lib.django_util import render
-
 __users_lock = threading.Lock()
 __users_lock = threading.Lock()
 
 
 
 
@@ -35,15 +33,22 @@ def list_users(request):
 
 
 def delete_user(request, username):
 def delete_user(request, username):
   if not request.user.is_superuser:
   if not request.user.is_superuser:
-    raise MessageException("You must be a superuser to delete users.")
+    raise PopupException("You must be a superuser to delete users.")
   if request.method == 'POST':
   if request.method == 'POST':
     try:
     try:
-      user = User.objects.get(username=username)
-      user.delete()
+      global __users_lock
+      __users_lock.acquire()
+      try:
+        user = User.objects.get(username=username)
+        _check_remove_last_super(user)
+        user.delete()
+      finally:
+        __users_lock.release()
+
       # Send a flash message saying "deleted"?
       # Send a flash message saying "deleted"?
       return list_users(request)
       return list_users(request)
     except User.DoesNotExist:
     except User.DoesNotExist:
-      raise MessageException("User not found.")
+      raise PopupException("User not found.")
   else:
   else:
     return render("confirm.mako",
     return render("confirm.mako",
       request,
       request,
@@ -94,8 +99,7 @@ def edit_user(request, username=None):
   @param username:      Default to None, when creating a new user
   @param username:      Default to None, when creating a new user
   """
   """
   if request.user.username != username and not request.user.is_superuser:
   if request.user.username != username and not request.user.is_superuser:
-    raise MessageException("You must be a superuser to add or edit another "
-                           "user.")
+    raise PopupException("You must be a superuser to add or edit another user.")
   if username is not None:
   if username is not None:
     instance = User.objects.get(username=username)
     instance = User.objects.get(username=username)
   else:
   else:
@@ -114,7 +118,7 @@ def edit_user(request, username=None):
         # (3) The last active superuser cannot demote/inactivate himself.
         # (3) The last active superuser cannot demote/inactivate himself.
         #
         #
         if request.user.username == username and not form.instance.is_active:
         if request.user.username == username and not form.instance.is_active:
-          raise MessageException("You cannot make yourself inactive.")
+          raise PopupException("You cannot make yourself inactive.")
 
 
         global __users_lock
         global __users_lock
         __users_lock.acquire()
         __users_lock.acquire()
@@ -123,17 +127,10 @@ def edit_user(request, username=None):
           orig = User.objects.get(username=username)
           orig = User.objects.get(username=username)
           if orig.is_superuser:
           if orig.is_superuser:
             if not form.instance.is_superuser or not form.instance.is_active:
             if not form.instance.is_superuser or not form.instance.is_active:
-              # Is there any other active superuser left?
-              all_active_su = User.objects.filter(is_superuser__exact = True,
-                                                  is_active__exact = True)
-              num_active_su = all_active_su.count()
-              assert num_active_su >= 1, "No active superuser configured"
-              if num_active_su == 1:
-                raise MessageException("You cannot remove the last active "
-                                       "superuser from the configuration.")
+              _check_remove_last_super(orig)
           else:
           else:
             if form.instance.is_superuser and not request.user.is_superuser:
             if form.instance.is_superuser and not request.user.is_superuser:
-              raise MessageException("You cannot make yourself a superuser.")
+              raise PopupException("You cannot make yourself a superuser.")
 
 
           # All ok
           # All ok
           form.save()
           form.save()
@@ -146,3 +143,18 @@ def edit_user(request, username=None):
     form = UserChangeForm(instance=instance)
     form = UserChangeForm(instance=instance)
   return render('edit_user.mako', request,
   return render('edit_user.mako', request,
     dict(form=form, action=request.path, username=username))
     dict(form=form, action=request.path, username=username))
+
+
+def _check_remove_last_super(user_obj):
+  """Raise an error if we're removing the last superuser"""
+  if not user_obj.is_superuser:
+    return
+
+  # Is there any other active superuser left?
+  all_active_su = User.objects.filter(is_superuser__exact = True,
+                                      is_active__exact = True)
+  num_active_su = all_active_su.count()
+  assert num_active_su >= 1, "No active superuser configured"
+  if num_active_su == 1:
+    raise PopupException("You cannot remove the last active "
+                         "superuser from the configuration.")