From 6262ad9a996571abed58149f2dfa288d3eac729b Mon Sep 17 00:00:00 2001 From: Joren Van Onder Date: Wed, 29 Jul 2015 11:45:04 +0200 Subject: [PATCH] [IMP] res_users: don't allow unactivating the current or admin user Try to protect users from locking themselves out. --- openerp/addons/base/res/res_users.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/openerp/addons/base/res/res_users.py b/openerp/addons/base/res/res_users.py index 570db6f2e30..0fa3aba8aee 100644 --- a/openerp/addons/base/res/res_users.py +++ b/openerp/addons/base/res/res_users.py @@ -321,6 +321,14 @@ class res_users(osv.osv): def write(self, cr, uid, ids, values, context=None): if not hasattr(ids, '__iter__'): ids = [ids] + + if values.get('active') == False: + for current_id in ids: + if current_id == SUPERUSER_ID: + raise UserError(_("You cannot unactivate the admin user.")) + elif current_id == uid: + raise UserError(_("You cannot unactivate the user you're currently logged in as.")) + if ids == [uid]: for key in values.keys(): if not (key in self.SELF_WRITEABLE_FIELDS or key.startswith('context_')):