From 253606c8bf5fac08c5e7ed3654ed4178c10cd8f4 Mon Sep 17 00:00:00 2001 From: AlanCoding Date: Thu, 31 May 2018 08:30:41 -0400 Subject: [PATCH] allow managing credentials with external user management --- awx/main/access.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/awx/main/access.py b/awx/main/access.py index ed2886f4b8..0f1a100946 100644 --- a/awx/main/access.py +++ b/awx/main/access.py @@ -537,8 +537,8 @@ class UserAccess(BaseAccess): return not self.user_membership_roles(u).exists() @check_superuser - def can_admin(self, obj, data, allow_orphans=False): - if not settings.MANAGE_ORGANIZATION_AUTH: + def can_admin(self, obj, data, allow_orphans=False, check_setting=True): + if check_setting and (not settings.MANAGE_ORGANIZATION_AUTH): return False if obj.is_superuser or obj.is_system_auditor: # must be superuser to admin users with system roles @@ -1071,7 +1071,7 @@ class CredentialAccess(BaseAccess): return True if data and data.get('user', None): user_obj = get_object_from_data('user', User, data) - return check_user_access(self.user, User, 'change', user_obj, None) + return bool(self.user == user_obj or UserAccess(self.user).can_admin(user_obj, None, check_setting=False)) if data and data.get('team', None): team_obj = get_object_from_data('team', Team, data) return check_user_access(self.user, Team, 'change', team_obj, None)