usmannasir/cyberpanel

[BUG] Risk of deletion of all sites when admin user is deleted

iqqmuT opened this issue · 2 comments

Describe the bug
Looking at the source, it seems that when admin user is deleted, there is a risk that all websites are deleted as well (when force is enabled).

To Reproduce

  1. Create a new user with admin ACL
  2. Delete user with admin ACL

Expected behavior
Not all sites are deleted.

Operating system:
Ubuntu 22.04 LTS

CyberPanel version:
2.3

Additional context
Related to #1336

submitUserDeletion() gets list of websites to be deleted by calling ACLManager.findAllSites(). If userInQuestion is admin, all websites are returned. However, this code is executed only when force is enabled. In which case force is enabled?

if force:
userACL = ACLManager.loadedACL(userInQuestion.pk)
websitesName = ACLManager.findAllSites(userACL, userInQuestion.pk)
from websiteFunctions.website import WebsiteManager
wm = WebsiteManager()
for website in websitesName:
wm.submitWebsiteDeletion(userID, {'websiteName': website})

Value of force is for you to decide?

Will close for no answer.