1 files changed, 69 insertions, 6 deletions

diff --git a/api/user.go b/api/user.go
index 4a52cf88b..886e38c91 100644
--- a/api/user.go
+++ b/api/user.go
@@ -334,6 +334,7 @@ func LoginByEmail(c *Context, w http.ResponseWriter, r *http.Request, email, nam
 
 	if result := <-Srv.Store.User().GetByEmail(team.Id, email); result.Err != nil {
 		c.Err = result.Err
+		c.Err.StatusCode = http.StatusForbidden
 		return nil
 	} else {
 		user := result.Data.(*model.User)
@@ -660,7 +661,7 @@ func getProfiles(c *Context, w http.ResponseWriter, r *http.Request) {
 		profiles := result.Data.(map[string]*model.User)
 
 		for k, p := range profiles {
-			options := utils.SanitizeOptions
+			options := utils.Cfg.GetSanitizeOptions()
 			options["passwordupdate"] = false
 
 			if c.IsSystemAdmin() {
@@ -669,6 +670,7 @@ func getProfiles(c *Context, w http.ResponseWriter, r *http.Request) {
 			}
 
 			p.Sanitize(options)
+			p.ClearNonProfileFields()
 			profiles[k] = p
 		}
 
@@ -1100,7 +1102,7 @@ func updateRoles(c *Context, w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	options := utils.SanitizeOptions
+	options := utils.Cfg.GetSanitizeOptions()
 	options["passwordupdate"] = false
 	ruser.Sanitize(options)
 	w.Write([]byte(ruser.ToJson()))
@@ -1195,6 +1197,14 @@ func updateActive(c *Context, w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	ruser := UpdateActive(c, user, active)
+
+	if c.Err == nil {
+		w.Write([]byte(ruser.ToJson()))
+	}
+}
+
+func UpdateActive(c *Context, user *model.User, active bool) *model.User {
 	if active {
 		user.DeleteAt = 0
 	} else {
@@ -1203,7 +1213,7 @@ func updateActive(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	if result := <-Srv.Store.User().Update(user, true); result.Err != nil {
 		c.Err = result.Err
-		return
+		return nil
 	} else {
 		c.LogAuditWithUserId(user.Id, fmt.Sprintf("active=%v", active))
 
@@ -1212,11 +1222,64 @@ func updateActive(c *Context, w http.ResponseWriter, r *http.Request) {
 		}
 
 		ruser := result.Data.([2]*model.User)[0]
-		options := utils.SanitizeOptions
+		options := utils.Cfg.GetSanitizeOptions()
 		options["passwordupdate"] = false
 		ruser.Sanitize(options)
-		w.Write([]byte(ruser.ToJson()))
+		return ruser
+	}
+}
+
+func PermanentDeleteUser(c *Context, user *model.User) *model.AppError {
+	l4g.Warn("Attempting to permanently delete account %v id=%v", user.Email, user.Id)
+	c.Path = "/users/permanent_delete"
+	c.LogAuditWithUserId(user.Id, fmt.Sprintf("attempt userId=%v", user.Id))
+	c.LogAuditWithUserId("", fmt.Sprintf("attempt userId=%v", user.Id))
+	if user.IsInRole(model.ROLE_SYSTEM_ADMIN) {
+		l4g.Warn("You are deleting %v that is a system administrator.  You may need to set another account as the system administrator using the command line tools.", user.Email)
+	}
+
+	UpdateActive(c, user, false)
+
+	if result := <-Srv.Store.Session().PermanentDeleteSessionsByUser(user.Id); result.Err != nil {
+		return result.Err
+	}
+
+	if result := <-Srv.Store.OAuth().PermanentDeleteAuthDataByUser(user.Id); result.Err != nil {
+		return result.Err
+	}
+
+	if result := <-Srv.Store.Webhook().PermanentDeleteIncomingByUser(user.Id); result.Err != nil {
+		return result.Err
+	}
+
+	if result := <-Srv.Store.Webhook().PermanentDeleteOutgoingByUser(user.Id); result.Err != nil {
+		return result.Err
+	}
+
+	if result := <-Srv.Store.Preference().PermanentDeleteByUser(user.Id); result.Err != nil {
+		return result.Err
+	}
+
+	if result := <-Srv.Store.Channel().PermanentDeleteMembersByUser(user.Id); result.Err != nil {
+		return result.Err
 	}
+
+	if result := <-Srv.Store.Post().PermanentDeleteByUser(user.Id); result.Err != nil {
+		return result.Err
+	}
+
+	if result := <-Srv.Store.User().PermanentDelete(user.Id); result.Err != nil {
+		return result.Err
+	}
+
+	if result := <-Srv.Store.Audit().PermanentDeleteByUser(user.Id); result.Err != nil {
+		return result.Err
+	}
+
+	l4g.Warn("Permanently deleted account %v id=%v", user.Email, user.Id)
+	c.LogAuditWithUserId("", fmt.Sprintf("success userId=%v", user.Id))
+
+	return nil
 }
 
 func sendPasswordReset(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -1485,7 +1548,7 @@ func updateUserNotify(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.LogAuditWithUserId(user.Id, "")
 
 		ruser := result.Data.([2]*model.User)[0]
-		options := utils.SanitizeOptions
+		options := utils.Cfg.GetSanitizeOptions()
 		options["passwordupdate"] = false
 		ruser.Sanitize(options)
 		w.Write([]byte(ruser.ToJson()))