We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
In UsersController, we have a function to define who can delete and it goes like: `def delete_possible?(user) if user.nil? return false
return false elsif !current_user.admin? return false else return true end
end`
I think it is possible that users delete their own account but not other's so the first elsif should be elsif user != current_user
elsif user != current_user
The text was updated successfully, but these errors were encountered:
Yes, I think that this is wrong,
It should take into account that one can only delete its own children or account
def delete_possible?(user) if user.nil? return false elsif user == current_user return false elsif !current_user.admin? return false else return true end end
Sorry, something went wrong.
@sergio-ocon @alexvkcr I'll open a new branch and start working on it asap. The fix will go in a new PR I suppose, right?
No branches or pull requests
In UsersController, we have a function to define who can delete and it goes like:
`def delete_possible?(user)
if user.nil?
return false
end`
I think it is possible that users delete their own account but not other's so the first elsif should be
elsif user != current_user
The text was updated successfully, but these errors were encountered: