fix user self-removal

2022-05-03 11:42:59 +02:00
parent b624e0f625
commit ab5e8465b6
1 changed files with 6 additions and 1 deletions
--- a/server/api/controller/user.js
+++ b/server/api/controller/user.js
@@ -123,7 +123,12 @@ const userController = {

  async remove (req, res) {
    try {
-      const user = await User.findByPk(req.params.id)
+      let user
+      if (res.locals.user.is_admin && req.params.id) {
+        user = await User.findByPk(req.params.id)
+      } else {
+        user = await User.findByPk(res.locals.user.id)  
+      }
      await user.destroy()
      log.warn(`User ${user.email} removed!`)
      res.sendStatus(200)