Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is this an error in UsersController? #43

Open
alexvkcr opened this issue Aug 29, 2016 · 2 comments
Open

Is this an error in UsersController? #43

alexvkcr opened this issue Aug 29, 2016 · 2 comments

Comments

@alexvkcr
Copy link
Collaborator

In UsersController, we have a function to define who can delete and it goes like:
`def delete_possible?(user)
if user.nil?
return false

  return false
elsif !current_user.admin?
  return false
else
  return true
end

end`

I think it is possible that users delete their own account but not other's so the first elsif should be
elsif user != current_user

@chargio
Copy link
Member

chargio commented Aug 30, 2016

Yes, I think that this is wrong,

It should take into account that one can only delete its own children or account

def delete_possible?(user)
    if user.nil?
      return false
    elsif user == current_user
      return false
    elsif !current_user.admin?
      return false
    else
      return true
    end
  end
  1. Create tests
  2. See that the are red
  3. Fix it

@katafira
Copy link
Collaborator

@sergio-ocon @alexvkcr I'll open a new branch and start working on it asap. The fix will go in a new PR I suppose, right?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants