Prevent DeleteUser API abuse (#10125)

* fix & co

* word suggestions from @jolheiser
release/v1.15
6543 2020-02-03 17:46:33 +01:00 committed by GitHub
parent 29151b90c6
commit ea50f60df2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 1 deletions

View File

@ -7,6 +7,7 @@ package admin
import (
"errors"
"fmt"
"net/http"
"code.gitea.io/gitea/models"
@ -227,6 +228,11 @@ func DeleteUser(ctx *context.APIContext) {
return
}
if u.IsOrganization() {
ctx.Error(http.StatusUnprocessableEntity, "", fmt.Errorf("%s is an organization not a user", u.Name))
return
}
if err := models.DeleteUser(u); err != nil {
if models.IsErrUserOwnRepos(err) ||
models.IsErrUserHasOrgs(err) {

View File

@ -115,7 +115,7 @@ func SettingsDeleteAvatar(ctx *context.Context) {
ctx.Redirect(ctx.Org.OrgLink + "/settings")
}
// SettingsDelete response for delete repository
// SettingsDelete response for deleting an organization
func SettingsDelete(ctx *context.Context) {
ctx.Data["Title"] = ctx.Tr("org.settings")
ctx.Data["PageIsSettingsDelete"] = true