diff options
Diffstat (limited to 'api/user.go')
-rw-r--r-- | api/user.go | 75 |
1 files changed, 69 insertions, 6 deletions
diff --git a/api/user.go b/api/user.go index 4a52cf88b..886e38c91 100644 --- a/api/user.go +++ b/api/user.go @@ -334,6 +334,7 @@ func LoginByEmail(c *Context, w http.ResponseWriter, r *http.Request, email, nam if result := <-Srv.Store.User().GetByEmail(team.Id, email); result.Err != nil { c.Err = result.Err + c.Err.StatusCode = http.StatusForbidden return nil } else { user := result.Data.(*model.User) @@ -660,7 +661,7 @@ func getProfiles(c *Context, w http.ResponseWriter, r *http.Request) { profiles := result.Data.(map[string]*model.User) for k, p := range profiles { - options := utils.SanitizeOptions + options := utils.Cfg.GetSanitizeOptions() options["passwordupdate"] = false if c.IsSystemAdmin() { @@ -669,6 +670,7 @@ func getProfiles(c *Context, w http.ResponseWriter, r *http.Request) { } p.Sanitize(options) + p.ClearNonProfileFields() profiles[k] = p } @@ -1100,7 +1102,7 @@ func updateRoles(c *Context, w http.ResponseWriter, r *http.Request) { } } - options := utils.SanitizeOptions + options := utils.Cfg.GetSanitizeOptions() options["passwordupdate"] = false ruser.Sanitize(options) w.Write([]byte(ruser.ToJson())) @@ -1195,6 +1197,14 @@ func updateActive(c *Context, w http.ResponseWriter, r *http.Request) { } } + ruser := UpdateActive(c, user, active) + + if c.Err == nil { + w.Write([]byte(ruser.ToJson())) + } +} + +func UpdateActive(c *Context, user *model.User, active bool) *model.User { if active { user.DeleteAt = 0 } else { @@ -1203,7 +1213,7 @@ func updateActive(c *Context, w http.ResponseWriter, r *http.Request) { if result := <-Srv.Store.User().Update(user, true); result.Err != nil { c.Err = result.Err - return + return nil } else { c.LogAuditWithUserId(user.Id, fmt.Sprintf("active=%v", active)) @@ -1212,11 +1222,64 @@ func updateActive(c *Context, w http.ResponseWriter, r *http.Request) { } ruser := result.Data.([2]*model.User)[0] - options := utils.SanitizeOptions + options := utils.Cfg.GetSanitizeOptions() options["passwordupdate"] = false ruser.Sanitize(options) - w.Write([]byte(ruser.ToJson())) + return ruser + } +} + +func PermanentDeleteUser(c *Context, user *model.User) *model.AppError { + l4g.Warn("Attempting to permanently delete account %v id=%v", user.Email, user.Id) + c.Path = "/users/permanent_delete" + c.LogAuditWithUserId(user.Id, fmt.Sprintf("attempt userId=%v", user.Id)) + c.LogAuditWithUserId("", fmt.Sprintf("attempt userId=%v", user.Id)) + if user.IsInRole(model.ROLE_SYSTEM_ADMIN) { + l4g.Warn("You are deleting %v that is a system administrator. You may need to set another account as the system administrator using the command line tools.", user.Email) + } + + UpdateActive(c, user, false) + + if result := <-Srv.Store.Session().PermanentDeleteSessionsByUser(user.Id); result.Err != nil { + return result.Err + } + + if result := <-Srv.Store.OAuth().PermanentDeleteAuthDataByUser(user.Id); result.Err != nil { + return result.Err + } + + if result := <-Srv.Store.Webhook().PermanentDeleteIncomingByUser(user.Id); result.Err != nil { + return result.Err + } + + if result := <-Srv.Store.Webhook().PermanentDeleteOutgoingByUser(user.Id); result.Err != nil { + return result.Err + } + + if result := <-Srv.Store.Preference().PermanentDeleteByUser(user.Id); result.Err != nil { + return result.Err + } + + if result := <-Srv.Store.Channel().PermanentDeleteMembersByUser(user.Id); result.Err != nil { + return result.Err } + + if result := <-Srv.Store.Post().PermanentDeleteByUser(user.Id); result.Err != nil { + return result.Err + } + + if result := <-Srv.Store.User().PermanentDelete(user.Id); result.Err != nil { + return result.Err + } + + if result := <-Srv.Store.Audit().PermanentDeleteByUser(user.Id); result.Err != nil { + return result.Err + } + + l4g.Warn("Permanently deleted account %v id=%v", user.Email, user.Id) + c.LogAuditWithUserId("", fmt.Sprintf("success userId=%v", user.Id)) + + return nil } func sendPasswordReset(c *Context, w http.ResponseWriter, r *http.Request) { @@ -1485,7 +1548,7 @@ func updateUserNotify(c *Context, w http.ResponseWriter, r *http.Request) { c.LogAuditWithUserId(user.Id, "") ruser := result.Data.([2]*model.User)[0] - options := utils.SanitizeOptions + options := utils.Cfg.GetSanitizeOptions() options["passwordupdate"] = false ruser.Sanitize(options) w.Write([]byte(ruser.ToJson())) |