rattail/tailbone
2
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

Expose, honor the prevent_password_change flag for Users

Browse source
This commit is contained in:
Lance Edgar 2023-05-02 19:13:28 -05:00
parent 2863ff7a5c
commit f913ed8332
5 changed files with 24 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

7
tailbone/api/auth.py
View file

@ -2,7 +2,7 @@
################################################################################
#
# Rattail -- Retail Software Framework
# Copyright © 2010-2022 Lance Edgar
# Copyright © 2010-2023 Lance Edgar
#
# This file is part of Rattail.
#
@ -24,8 +24,6 @@
Tailbone Web API - Auth Views
"""
from __future__ import unicode_literals, absolute_import
from rattail.db.auth import set_user_password
from cornice import Service
@ -168,6 +166,9 @@ class AuthenticationView(APIView):
if not self.request.user:
raise self.forbidden()
if self.request.user.prevent_password_change and not self.request.is_root:
raise self.forbidden()
data = self.request.json_body
# first make sure "current" password is accurate

8
tailbone/api/users.py
View file

@ -2,7 +2,7 @@
################################################################################
#
# Rattail -- Retail Software Framework
# Copyright © 2010-2022 Lance Edgar
# Copyright © 2010-2023 Lance Edgar
#
# This file is part of Rattail.
#
@ -24,8 +24,6 @@
Tailbone Web API - User Views
"""
from __future__ import unicode_literals, absolute_import
from rattail.db import model
from tailbone.api import APIMasterView
@ -57,6 +55,10 @@ class UserView(APIMasterView):
query = query.outerjoin(model.Person)
return query
def update_object(self, user, data):
# TODO: should ensure prevent_password_change is respected
return super(UserView, self).update_object(user, data)
def defaults(config, **kwargs):
base = globals()