6fdb17cbbe
- Add a `destroy_user` ability. This didn't exist before, and was implicit in other abilities (only admins could access the admin area, so only they could destroy all users; a user can only access their own account page, and so can destroy only themselves). - Grant this ability to admins, and when the current user is trying to destroy themselves. Disallow destroying ghost users in all cases. - Modify the `Users::DestroyService` to check this ability. Also check it in views to decide whether or not to show the "Delete User" button. - Add a short summary of the Ghost User to the bio.
19 lines
437 B
Ruby
19 lines
437 B
Ruby
class UserPolicy < BasePolicy
|
|
include Gitlab::CurrentSettings
|
|
|
|
def rules
|
|
can! :read_user if @user || !restricted_public_level?
|
|
|
|
if @user
|
|
if @user.admin? || @subject == @user
|
|
can! :destroy_user
|
|
end
|
|
|
|
cannot! :destroy_user if @subject.ghost?
|
|
end
|
|
end
|
|
|
|
def restricted_public_level?
|
|
current_application_settings.restricted_visibility_levels.include?(Gitlab::VisibilityLevel::PUBLIC)
|
|
end
|
|
end
|