Admins should not be able to deactivate their own accounts
Dominik Sander
共有 3 個文件被更改，包括 13 次插入 和 6 次删除
+ 1
- 1
app/controllers/admin/users_controller.rb
@@ -6,7 +6,7 @@ class Admin::UsersController < ApplicationController |
||
| 6 | 6 |
helper_method :resource |
| 7 | 7 |
|
| 8 | 8 |
def index |
| 9 |
- @users = User.reorder(:created_at).page(params[:page]) |
|
| 9 |
+ @users = User.reorder('created_at DESC').page(params[:page])
|
|
| 10 | 10 |
|
| 11 | 11 |
respond_to do |format| |
| 12 | 12 |
format.html |
+ 7
- 5
app/views/admin/users/index.html.erb
@@ -29,12 +29,14 @@ |
||
| 29 | 29 |
<td title='<%= user.created_at %>'><%= time_ago_in_words user.created_at %> ago</td> |
| 30 | 30 |
<td> |
| 31 | 31 |
<div class="btn-group btn-group-xs"> |
| 32 |
- <% if user.active? %> |
|
| 33 |
- <%= link_to 'Deactivate', deactivate_admin_user_path(user), method: :put, class: "btn btn-default" %> |
|
| 34 |
- <% else %> |
|
| 35 |
- <%= link_to 'Activate', activate_admin_user_path(user), method: :put, class: "btn btn-default" %> |
|
| 32 |
+ <% if user != current_user %> |
|
| 33 |
+ <% if user.active? %> |
|
| 34 |
+ <%= link_to 'Deactivate', deactivate_admin_user_path(user), method: :put, class: "btn btn-default" %> |
|
| 35 |
+ <% else %> |
|
| 36 |
+ <%= link_to 'Activate', activate_admin_user_path(user), method: :put, class: "btn btn-default" %> |
|
| 37 |
+ <% end %> |
|
| 38 |
+ <%= link_to 'Delete', admin_user_path(user), method: :delete, data: { confirm: 'Are you sure? This can not be undone.' }, class: "btn btn-default" %>
|
|
| 36 | 39 |
<% end %> |
| 37 |
- <%= link_to 'Delete', admin_user_path(user), method: :delete, data: { confirm: 'Are you sure? This can not be undone.' }, class: "btn btn-default" %>
|
|
| 38 | 40 |
</div> |
| 39 | 41 |
</td> |
| 40 | 42 |
</tr> |
+ 5
- 0
spec/features/admin_users_spec.rb
@@ -80,6 +80,11 @@ describe Admin::UsersController do |
||
| 80 | 80 |
end |
| 81 | 81 |
|
| 82 | 82 |
context "(de)activating users" do |
| 83 |
+ it "does not show deactivation buttons for the current user" do |
|
| 84 |
+ visit admin_users_path |
|
| 85 |
+ expect(page).not_to have_css("a[href='/admin/users/#{users(:jane).id}/deactivate']")
|
|
| 86 |
+ end |
|
| 87 |
+ |
|
| 83 | 88 |
it "deactivates an existing user" do |
| 84 | 89 |
visit admin_users_path |
| 85 | 90 |
expect(page).not_to have_text('inactive')
|