diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php index bcf932e2..4eb8ff9b 100644 --- a/app/Http/Controllers/UserController.php +++ b/app/Http/Controllers/UserController.php @@ -167,9 +167,14 @@ class UserController extends Controller 'password' => 'required|min:6|max:32' ]); + if ($user->isAdmin()) + return json(trans('user.profile.delete.admin'), 1); + if (! $user->verifyPassword($request->input('password'))) return json(trans('user.profile.delete.wrong-password'), 1); + Auth::logout(); + if ($user->delete()) { session()->flush(); diff --git a/tests/UserControllerTest.php b/tests/UserControllerTest.php index 9a47a300..1fab32ad 100644 --- a/tests/UserControllerTest.php +++ b/tests/UserControllerTest.php @@ -382,6 +382,16 @@ class UserControllerTest extends TestCase 'msg' => trans('user.profile.delete.success') ]); $this->assertNull(User::find($user->uid)); + + // Administrator cannot be deleted + $this->actAs('admin') + ->postJson('/user/profile', [ + 'action' => 'delete', + 'password' => '87654321' + ])->assertJson([ + 'errno' => 1, + 'msg' => trans('user.profile.delete.admin') + ]); } public function testSetAvatar()