Do not deactivate superusers #7105
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds protection to prevent superusers from being deactivated through the user management interface, mirroring the existing protection for system accounts.
Key changes:
- Added
user.is_superusercheck to the deactivate view logic - Updated the profile template to hide deactivation buttons for superusers
- Added comprehensive test coverage for both regular and spam deactivation paths
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| kitsune/users/views.py | Added or user.is_superuser condition to prevent deactivation of superusers alongside system accounts |
| kitsune/users/jinja2/users/profile.html | Extended template condition to hide deactivation buttons when viewing superuser profiles |
| kitsune/users/tests/test_views.py | Added two test cases verifying superusers cannot be deactivated via regular or spam deactivation endpoints |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
|
|
||
| {% if user.id != profile.user.id and user.has_perm('users.deactivate_users') and not profile.is_system_account %} | ||
| {% if user.id != profile.user.id and user.has_perm('users.deactivate_users') and not profile.is_system_account and not profile.user.is_superuser %} |
There was a problem hiding this comment.
The template change to hide the deactivate button for superusers lacks test coverage. Consider adding a test in test_templates.py similar to the existing test_deactivate_button test to verify that the deactivate button is properly hidden when viewing a superuser's profile.
| def deactivate(request, mark_spam=False): | ||
| user = get_object_or_404(User, id=request.POST["user_id"], is_active=True) | ||
| if user.profile.is_system_account: | ||
| if user.profile.is_system_account or user.is_superuser: |
There was a problem hiding this comment.
The admin action _deactivate_users in kitsune/users/monkeypatch.py (lines 16-19) also allows deactivation of users but doesn't include the same superuser protection. Consider adding similar filtering to that admin action to ensure superusers cannot be deactivated through the Django admin interface.
2 participants
No description provided.