Admin users/superusers can remove their own admin status locking themselves out in future

sfbrigade / bats-server

Routed is an app to help ambulances direct non-critical patients to hospital emergency rooms with the most availability.

https://routedapp.org/

GNU Affero General Public License v3.0

18 stars 11 forks source link

Admin users/superusers can remove their own admin status locking themselves out in future #325

Open pnilan opened 9 months ago

pnilan commented 9 months ago

Issue

An administrative user or superuser can deselect "administrative" from the edit user page for their own user account. This won't have an immediate effect, but in future login attempts, the user will be locked out of admin dashboard.

Notes

More of a policy issue -- should we allow users to edit their own admin status? Requires further discussion.