TT#129169 API: DELETE /api/admins/:id return wrong http 500

* Fix http code to 403 - Cannot delete own user

Change-Id: I21225e112fd7e5b746381753b2e52474b6069c5c
mr10.3
Oleksandr Duts 3 years ago
parent 81ebdb8dcf
commit e5dd7e5587

@ -79,20 +79,20 @@ sub delete_item {
if($item->login eq $special_user_login) {
$self->error($c, HTTP_FORBIDDEN, "Cannot delete special user '$special_user_login'");
last;
return;
}
if($c->user->id == $item->id) {
$self->error($c, HTTP_FORBIDDEN, "Cannot delete own user");
last;
return;
}
if($c->user->read_only) {
$self->error($c, HTTP_FORBIDDEN, "Insufficient permissions");
last;
return;
}
# reseller association is checked in item_rs of role
last unless $self->add_delete_journal_item_hal($c,sub {
return unless $self->add_delete_journal_item_hal($c,sub {
my $self = shift;
my ($c) = @_;
return $self->hal_from_item($c, $item); });

@ -218,6 +218,15 @@
'${admin}.is_ccare': 0
'${admin}.lawful_intercept': 0
-
name: delete own user
type: item
method: DELETE
path: '/api/admins/1'
conditions:
is:
code: 403
-
name: delete admin
type: item
@ -225,4 +234,4 @@
path: '/${admin_path}'
conditions:
is:
code: 204
code: 204
Loading…
Cancel
Save