Bug 2403 Fixed: Able to change username of other users with no admin privileges
Change-Id: If5648c82e8bf2cd746877e560c14851a585f4385
Signed-off-by: adurti <adurti.v@tataelxsi.co.in>
diff --git a/osm_nbi/admin_topics.py b/osm_nbi/admin_topics.py
index e560887..e496806 100644
--- a/osm_nbi/admin_topics.py
+++ b/osm_nbi/admin_topics.py
@@ -1131,6 +1131,16 @@
http_code=HTTPStatus.BAD_REQUEST,
)
+ # username change
+ if indata.get("username"):
+ if not session.get("admin_show"):
+ if not indata.get("system_admin_id"):
+ if _id != session["user_id"]:
+ raise EngineException(
+ "You are not allowed to change other users username",
+ http_code=HTTPStatus.BAD_REQUEST,
+ )
+
# user = self.show(session, _id) # Already in 'content'
original_mapping = content["project_role_mappings"]