jro_apps/redmine Commit - r9283:28f0c4f131b0

Adds the ability for users to delete their own account (#10664). Can be disabled in application settings....

Jean-Philippe Lang -

r9283:28f0c4f131b0

parent child

Context file:

r9283:28f0c4f131b0

Collapse all files

app/views/my/destroy.html.erb created 644 +11 0

@@ -0,0 +1,11
	1	<h2><%=l(:label_confirmation)%></h2>
	2	<div class="warning">
	3	<p><%= simple_format l(:text_account_destroy_confirmation)%></p>
	4	<p>
	5	<% form_tag({}) do %>
	6	<label><%= check_box_tag 'confirm', 1 %> <%= l(:general_text_Yes) %></label>
	7	<%= submit_tag l(:button_delete_my_account) %> \|
	8	<%= link_to l(:button_cancel), :action => 'account' %>
	9	<% end %>
	10	</p>
	11	</div>

app/controllers/account_controller.rb 0 -8

               private
-              def logout_user
-                if User.current.logged?
-                  cookies.delete :autologin
-                  Token.delete_all(["user_id = ? AND action = ?", User.current.id, 'autologin'])
-                  self.logged_user = nil
-                end
-              end
               def authenticate_user
                 if Setting.openid? && using_open_id?
                   open_id_authenticate(params[:openid_url])

app/controllers/application_controller.rb +9 0

@@ -126,6 +126,15 class ApplicationController < ActionController::Base
126	end	126	end
127	end	127	end
128		128
		129	# Logs out current user
		130	def logout_user
		131	if User.current.logged?
		132	cookies.delete :autologin
		133	Token.delete_all(["user_id = ? AND action = ?", User.current.id, 'autologin'])
		134	self.logged_user = nil
		135	end
		136	end
		137
129	# check if login is globally required to access the application	138	# check if login is globally required to access the application
130	def check_if_login_required	139	def check_if_login_required
131	# no check needed if user is already logged in	140	# no check needed if user is already logged in

app/controllers/my_controller.rb +18 0

@@ -65,6 +65,24 class MyController < ApplicationController
65	end	65	end
66	end	66	end
67		67
		68	# Destroys user's account
		69	def destroy
		70	@user = User.current
		71	unless @user.own_account_deletable?
		72	redirect_to :action => 'account'
		73	return
		74	end
		75
		76	if request.post? && params[:confirm]
		77	@user.destroy
		78	if @user.destroyed?
		79	logout_user
		80	flash[:notice] = l(:notice_account_deleted)
		81	end
		82	redirect_to home_path
		83	end
		84	end
		85
68	# Manage user's password	86	# Manage user's password
69	def password	87	def password
70	@user = User.current	88	@user = User.current

app/models/user.rb +6 0

                 allowed_to?(action, nil, options.reverse_merge(:global => true), &block)
               end
+              # Returns true if the user is allowed to delete his own account
+              def own_account_deletable?
+                Setting.unsubscribe? &&
+                  (!admin? || User.active.first(:conditions => ["admin = ? AND id <> ?", true, id]).present?)
+              end
               safe_attributes 'login',
                 'firstname',
                 'lastname',

app/views/my/_sidebar.html.erb +3 0

             <p><%=l(:field_login)%>: <strong><%= link_to_user(@user, :format => :username) %></strong><br />
             <%=l(:field_created_on)%>: <%= format_time(@user.created_on) %></p>
+            <% if @user.own_account_deletable? %>
+              <p><%= link_to(l(:button_delete_my_account), {:action => 'destroy'}, :class => 'icon icon-del') %></p>
+            <% end %>
             <h4><%= l(:label_feeds_access_key) %></h4>

app/views/settings/_authentication.html.erb +2 0

                                                        [l(:label_registration_manual_activation), "2"],
                                                        [l(:label_registration_automatic_activation), "3"]] %></p>
+            <p><%= setting_check_box :unsubscribe %></p>
             <p><%= setting_text_field :password_min_length, :size => 6 %></p>
             <p><%= setting_check_box :lost_password, :label => :label_password_lost %></p>

config/locales/en.yml +4 0

               notice_gantt_chart_truncated: "The chart was truncated because it exceeds the maximum number of items that can be displayed (%{max})"
               notice_issue_successful_create: "Issue %{id} created."
               notice_issue_update_conflict: "The issue has been updated by an other user while you were editing it."
+              notice_account_deleted: "Your account has been permanently deleted."
               error_can_t_load_default_data: "Default configuration could not be loaded: %{value}"
               error_scm_not_found: "The entry or revision was not found in the repository."
               setting_issue_group_assignment: Allow issue assignment to groups
               setting_default_issue_start_date_to_creation_date: Use current date as start date for new issues
               setting_commit_cross_project_ref: Allow issues of all the other projects to be referenced and fixed
+              setting_unsubscribe: Allow users to unsubscribe
               permission_add_project: Create project
               permission_add_subprojects: Create subprojects
               button_show: Show
               button_edit_section: Edit this section
               button_export: Export
+              button_delete_my_account: Delete my account
               status_active: active
               status_registered: registered
               text_issue_conflict_resolution_overwrite: "Apply my changes anyway (previous notes will be kept but some changes may be overwritten)"
               text_issue_conflict_resolution_add_notes: "Add my notes and discard my other changes"
               text_issue_conflict_resolution_cancel: "Discard all my changes and redisplay %{link}"
+              text_account_destroy_confirmation: "Are you sure you want to proceed?\nYour account will be permanently deleted, with no way to reactivate it."
               default_role_manager: Manager
               default_role_developer: Developer

config/locales/fr.yml +4 0

               notice_gantt_chart_truncated: "Le diagramme a été tronqué car il excède le nombre maximal d'éléments pouvant être affichés (%{max})"
               notice_issue_successful_create: "La demande %{id} a été créée."
               notice_issue_update_conflict: "La demande a été mise à jour par un autre utilisateur pendant que vous la modifiez."
+              notice_account_deleted: "Votre compte a été définitivement supprimé."
               error_can_t_load_default_data: "Une erreur s'est produite lors du chargement du paramétrage : %{value}"
               error_scm_not_found: "L'entrée et/ou la révision demandée n'existe pas dans le dépôt."
               setting_issue_group_assignment: Permettre l'assignement des demandes aux groupes
               setting_default_issue_start_date_to_creation_date: Donner à la date de début d'une nouvelle demande la valeur de la date du jour
               setting_commit_cross_project_ref: Permettre le référencement et la résolution des demandes de tous les autres projets
+              setting_unsubscribe: Permettre aux utilisateurs de se désinscrire
               permission_add_project: Créer un projet
               permission_add_subprojects: Créer des sous-projets
               button_show: Afficher
               button_edit_section: Modifier cette section
               button_export: Exporter
+              button_delete_my_account: Supprimer mon compte
               status_active: actif
               status_registered: enregistré
               text_issue_conflict_resolution_overwrite: "Appliquer quand même ma mise à jour (les notes précédentes seront conservées mais des changements pourront être écrasés)"
               text_issue_conflict_resolution_add_notes: "Ajouter mes notes et ignorer mes autres changements"
               text_issue_conflict_resolution_cancel: "Annuler ma mise à jour et réafficher %{link}"
+              text_account_destroy_confirmation: "Êtes-vous sûr de vouloir continuer ?\nVotre compte sera définitivement supprimé, sans aucune possibilité de le réactiver."
               default_role_manager: "Manager "
               default_role_developer: "Développeur "

config/routes.rb +2 0

               map.connect 'my/account', :controller => 'my', :action => 'account',
                           :conditions => {:method => [:get, :post]}
+              map.connect 'my/account/destroy', :controller => 'my', :action => 'destroy',
+                          :conditions => {:method => [:get, :post]}
               map.connect 'my/page', :controller => 'my', :action => 'page',
                           :conditions => {:method => :get}
               # Redirects to my/page

config/settings.yml +2 0

               default: '2'
             lost_password:
               default: 1
+            unsubscribe:
+              default: 1
             password_min_length:
               format: int
               default: 4

test/functional/my_controller_test.rb +39 0

@@ -84,6 +84,45 class MyControllerTest < ActionController::TestCase
84	assert user.groups.empty?	84	assert user.groups.empty?
85	end	85	end
86		86
		87	def test_my_account_should_show_destroy_link
		88	get :account
		89	assert_select 'a[href=/my/account/destroy]'
		90	end
		91
		92	def test_get_destroy_should_display_the_destroy_confirmation
		93	get :destroy
		94	assert_response :success
		95	assert_template 'destroy'
		96	assert_select 'form[action=/my/account/destroy]' do
		97	assert_select 'input[name=confirm]'
		98	end
		99	end
		100
		101	def test_post_destroy_without_confirmation_should_not_destroy_account
		102	assert_no_difference 'User.count' do
		103	post :destroy
		104	end
		105	assert_response :success
		106	assert_template 'destroy'
		107	end
		108
		109	def test_post_destroy_without_confirmation_should_destroy_account
		110	assert_difference 'User.count', -1 do
		111	post :destroy, :confirm => '1'
		112	end
		113	assert_redirected_to '/'
		114	assert_match /deleted/i, flash[:notice]
		115	end
		116
		117	def test_post_destroy_with_unsubscribe_not_allowed_should_not_destroy_account
		118	User.any_instance.stubs(:own_account_deletable?).returns(false)
		119
		120	assert_no_difference 'User.count' do
		121	post :destroy, :confirm => '1'
		122	end
		123	assert_redirected_to '/my/account'
		124	end
		125
87	def test_change_password	126	def test_change_password
88	get :password	127	get :password
89	assert_response :success	128	assert_response :success

test/integration/routing/my_test.rb +6 0

                       { :controller => 'my', :action => 'account' }
                     )
                 end
+                ["get", "post"].each do |method|
+                  assert_routing(
+                      { :method => method, :path => "/my/account/destroy" },
+                      { :controller => 'my', :action => 'destroy' }
+                    )
+                end
                 assert_routing(
                     { :method => 'get', :path => "/my/page" },
                     { :controller => 'my', :action => 'page' }

test/unit/user_test.rb +27 0

@@ -770,7 +770,34 class UserTest < ActiveSupport::TestCase
770	user.auth_source = denied_auth_source	770	user.auth_source = denied_auth_source
771	assert !user.change_password_allowed?, "User allowed to change password, though auth source does not"	771	assert !user.change_password_allowed?, "User allowed to change password, though auth source does not"
772	end	772	end
		773	end
		774
		775	def test_own_account_deletable_should_be_true_with_unsubscrive_enabled
		776	with_settings :unsubscribe => '1' do
		777	assert_equal true, User.find(2).own_account_deletable?
		778	end
		779	end
		780
		781	def test_own_account_deletable_should_be_false_with_unsubscrive_disabled
		782	with_settings :unsubscribe => '0' do
		783	assert_equal false, User.find(2).own_account_deletable?
		784	end
		785	end
773		786
		787	def test_own_account_deletable_should_be_false_for_a_single_admin
		788	User.delete_all(["admin = ? AND id <> ?", true, 1])
		789
		790	with_settings :unsubscribe => '1' do
		791	assert_equal false, User.find(1).own_account_deletable?
		792	end
		793	end
		794
		795	def test_own_account_deletable_should_be_true_for_an_admin_if_other_admin_exists
		796	User.generate_with_protected(:admin => true)
		797
		798	with_settings :unsubscribe => '1' do
		799	assert_equal true, User.find(1).own_account_deletable?
		800	end
774	end	801	end
775		802
776	context "#allowed_to?" do	803	context "#allowed_to?" do

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages