add optional setting to prevent initial admin user from being modified or deleted
@@ -108,6 +108,13 @@ class GetUpdateDeleteUser(APIView):
def put(self, request, pk):
user = get_object_or_404(User, pk=pk)
+ if (
+ hasattr(settings, "ROOT_USER")
+ and request.user != user
+ and user.username == settings.ROOT_USER
+ ):
+ return notify_error("The root user cannot be modified from the UI")
+
serializer = UserSerializer(instance=user, data=request.data, partial=True)
serializer.is_valid(raise_exception=True)
serializer.save()
@@ -115,7 +122,15 @@ class GetUpdateDeleteUser(APIView):
return Response("ok")
def delete(self, request, pk):
- get_object_or_404(User, pk=pk).delete()
+ user = get_object_or_404(User, pk=pk)
+ if (
+ hasattr(settings, "ROOT_USER")
+ and request.user != user
+ and user.username == settings.ROOT_USER
+ ):
+ return notify_error("The root user cannot be deleted from the UI")
+
+ user.delete()
return Response("ok")
@@ -124,8 +139,14 @@ class UserActions(APIView):
# reset password
def post(self, request):
-
user = get_object_or_404(User, pk=request.data["id"])
+ if (
+ hasattr(settings, "ROOT_USER")
+ and request.user != user
+ and user.username == settings.ROOT_USER
+ ):
+ return notify_error("The root user cannot be modified from the UI")
+
user.set_password(request.data["password"])
user.save()
@@ -133,8 +154,14 @@ class UserActions(APIView):
# reset two factor token
def put(self, request):
-
user = get_object_or_404(User, pk=request.data["id"])
+ if (
+ hasattr(settings, "ROOT_USER")
+ and request.user != user
+ and user.username == settings.ROOT_USER
+ ):
+ return notify_error("The root user cannot be modified from the UI")
+
user.totp_key = ""
user.save()
