jro_apps/redmine Commit - r4609:e9f62d1209bf

Enable ability for administrators to delete users (#7296)....

Jean-Philippe Lang -

r4609:e9f62d1209bf

parent child

Context file:

r4609:e9f62d1209bf

app/controllers/users_controller.rb +11 -2

               layout 'admin'
               before_filter :require_admin, :except => :show
-              before_filter :find_user, :only => [:show, :edit, :update, :edit_membership, :destroy_membership]
+              before_filter :find_user, :only => [:show, :edit, :update, :destroy, :edit_membership, :destroy_membership]
-              accept_key_auth :index, :show, :create, :update
+              accept_key_auth :index, :show, :create, :update, :destroy
               helper :sort
               include SortHelper
                 redirect_to :controller => 'users', :action => 'edit', :id => @user
               end
+              verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
+              def destroy
+                @user.destroy
+                respond_to do |format|
+                  format.html { redirect_to(users_url) }
+                  format.api  { head :ok }
+                end
+              end
               def edit_membership
                 @membership = Member.edit_membership(params[:membership_id], params[:membership], @user)
                 @membership.save if request.post?

app/views/users/edit.rhtml +1 0

             <div class="contextual">
             <%= link_to l(:label_profile), user_path(@user), :class => 'icon icon-user' %>
             <%= change_status_link(@user) %>
+            <%= link_to(l(:button_delete), @user, :confirm => l(:text_are_you_sure), :method => :delete, :class => 'icon icon-del') if User.current != @user %>
             </div>
             <h2><%= link_to l(:label_user_plural), :controller => 'users', :action => 'index' %> &#187; <%=h @user.login %></h2>

app/views/users/index.rhtml +4 -1

             	<td align="center"><%= checked_image user.admin? %></td>
             	<td class="created_on" align="center"><%= format_time(user.created_on) %></td>
             	<td class="last_login_on" align="center"><%= format_time(user.last_login_on) unless user.last_login_on.nil? %></td>
-                <td><small><%= change_status_link(user) %></small></td>
+                <td class="buttons">
+                	<%= change_status_link(user) %>
+                	<%= link_to(l(:button_delete), user, :confirm => l(:text_are_you_sure), :method => :delete, :class => 'icon icon-del') unless User.current == user %>
+                </td>
               </tr>
             <% end -%>
               </tbody>

config/routes.rb +1 -2

               map.resources :users, :member => {
                 :edit_membership => :post,
                 :destroy_membership => :post
-              },
-              :except => [:destroy]
               # For nice "roadmap" in the url for the index action
               map.connect 'projects/:project_id/roadmap', :controller => 'versions', :action => 'index'

test/functional/users_controller_test.rb +24 0

@@ -264,6 +264,30 class UsersControllerTest < ActionController::TestCase
264	assert u.check_password?('newpass')	264	assert u.check_password?('newpass')
265	end	265	end
266		266
		267	def test_destroy
		268	assert_difference 'User.count', -1 do
		269	delete :destroy, :id => 2
		270	end
		271	assert_redirected_to '/users'
		272	assert_nil User.find_by_id(2)
		273	end
		274
		275	def test_destroy_should_not_accept_get_requests
		276	assert_no_difference 'User.count' do
		277	get :destroy, :id => 2
		278	end
		279	assert_response 405
		280	end
		281
		282	def test_destroy_should_be_denied_for_non_admin_users
		283	@request.session[:user_id] = 3
		284
		285	assert_no_difference 'User.count' do
		286	get :destroy, :id => 2
		287	end
		288	assert_response 403
		289	end
		290
267	def test_edit_membership	291	def test_edit_membership
268	post :edit_membership, :id => 2, :membership_id => 1,	292	post :edit_membership, :id => 2, :membership_id => 1,
269	:membership => { :role_ids => [2]}	293	:membership => { :role_ids => [2]}

test/integration/api_test/users_test.rb +25 -15

@@ -245,26 +245,36 class ApiTest::UsersTest < ActionController::IntegrationTest
245	end	245	end
246	end	246	end
247	end	247	end
		248	end
248		249
249	context "DELETE /users/2" do	250	context "DELETE /users/2" do
250	context ".xml" do	251	context ".xml" do
251	should "not be allowed" do	252	should_allow_api_authentication(:delete,
252	assert_no_difference('User.count') do	253	'/users/2.xml',
253	delete '/users/2.xml'	254	{},
254	end	255	{:success_code => :ok})
255		256
256	assert_response :method_not_allowed	257	should "delete user" do
		258	assert_difference('User.count', -1) do
		259	delete '/users/2.xml', {}, :authorization => credentials('admin')
257	end	260	end
		261
		262	assert_response :ok
258	end	263	end
259		264	end
260	context ".json" do	265
261	should "not be allowed" do	266	context ".json" do
262	assert_no_difference('User.count') do	267	should_allow_api_authentication(:delete,
263	~~delete~~ '/users/2.~~json'~~	268	'/users/2.xml',
264	~~end~~	269	{},
		270	{:success_code => :ok})
265		271
266	assert_response :method_not_allowed	272	should "delete user" do
		273	assert_difference('User.count', -1) do
		274	delete '/users/2.json', {}, :authorization => credentials('admin')
267	end	275	end
		276
		277	assert_response :ok
268	end	278	end
269	end	279	end
270	end	280	end

test/integration/routing_test.rb +3 0

                 should_route :put, "/users/444", :controller => 'users', :action => 'update', :id => '444'
                 should_route :put, "/users/444.xml", :controller => 'users', :action => 'update', :id => '444', :format => 'xml'
+                should_route :delete, "/users/44", :controller => 'users', :action => 'destroy', :id => '44'
+                should_route :delete, "/users/44.xml", :controller => 'users', :action => 'destroy', :id => '44', :format => 'xml'
               end
               # TODO: should they all be scoped under /projects/:project_id ?

General Comments 0

You need to be logged in to leave comments. Login now

No TODOs yet

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages