External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-29 06:45:09 -02:30
Code Issues Packages Projects Releases Wiki Activity

Tightened user can_admin access so only sys admins and org admins can admin users

Browse Source
This commit is contained in:
Akita Noek
2016-03-22 11:40:06 -04:00
parent 4dcf51e791
commit cb83ee3ec6
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
awx/main/access.py
View File

@@ -244,7 +244,7 @@ class UserAccess(BaseAccess):
# Admin implies changing all user fields. # Admin implies changing all user fields.
if self.user.is_superuser: if self.user.is_superuser:
return True return True
return obj.accessible_by(self.user, {'create': True, 'write':True, 'update':True, 'read':True}) return Organization.objects.filter(member_role__members=obj, admin_role__members=self.user).exists()
def can_delete(self, obj): def can_delete(self, obj):
if obj == self.user: if obj == self.user: