[BUG] Risk of deletion of all sites when admin user is deleted
iqqmuT opened this issue · 2 comments
Describe the bug
Looking at the source, it seems that when admin user is deleted, there is a risk that all websites are deleted as well (when force
is enabled).
To Reproduce
- Create a new user with admin ACL
- Delete user with admin ACL
Expected behavior
Not all sites are deleted.
Operating system:
Ubuntu 22.04 LTS
CyberPanel version:
2.3
Additional context
Related to #1336
submitUserDeletion()
gets list of websites to be deleted by calling ACLManager.findAllSites()
. If userInQuestion
is admin, all websites are returned. However, this code is executed only when force
is enabled. In which case force
is enabled?
cyberpanel/userManagment/views.py
Lines 459 to 467 in b63d30a
Value of force is for you to decide?
cyberpanel/userManagment/views.py
Line 447 in b63d30a
Will close for no answer.