From 0f480be6580fa07a3494a216c6f4f423cbc6cff2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?= Date: Wed, 9 Dec 2020 10:15:30 -0500 Subject: [PATCH] fix: #9085, dont prevent admins from deleting other users --- public/language/en-GB/error.json | 1 + src/api/users.js | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/public/language/en-GB/error.json b/public/language/en-GB/error.json index 8782c9d665..63b5ebdee5 100644 --- a/public/language/en-GB/error.json +++ b/public/language/en-GB/error.json @@ -107,6 +107,7 @@ "cant-ban-other-admins": "You can't ban other admins!", "cant-remove-last-admin": "You are the only administrator. Add another user as an administrator before removing yourself as admin", + "account-deletion-disabled": "Account deletion is disabled", "cant-delete-admin": "Remove administrator privileges from this account before attempting to delete it.", "already-deleting": "Already deleting", diff --git a/src/api/users.js b/src/api/users.js index 6b763f1118..d65f450d29 100644 --- a/src/api/users.js +++ b/src/api/users.js @@ -250,8 +250,8 @@ async function processDeletion({ uid, method, password, caller }) { const isSelf = parseInt(uid, 10) === caller.uid; const isAdmin = await user.isAdministrator(caller.uid); - if (meta.config.allowAccountDelete !== 1) { - throw new Error('[[error:no-privileges]]'); + if (isSelf && meta.config.allowAccountDelete !== 1) { + throw new Error('[[error:account-deletion-disabled]]'); } else if (!isSelf && !isAdmin) { throw new Error('[[error:no-privileges]]'); } else if (isTargetAdmin) {