diff --git a/apimanager/users/templates/users/detail.html b/apimanager/users/templates/users/detail.html index 8c18ae9..d002015 100644 --- a/apimanager/users/templates/users/detail.html +++ b/apimanager/users/templates/users/detail.html @@ -27,6 +27,13 @@ {{ apiuser.provider_id }} +
+ {% csrf_token %} + + + +
+ {% if apiuser.user_id %}
diff --git a/apimanager/users/urls.py b/apimanager/users/urls.py index 94e6f40..956cbf0 100644 --- a/apimanager/users/urls.py +++ b/apimanager/users/urls.py @@ -5,7 +5,7 @@ URLs for users app from django.conf.urls import url -from .views import IndexView, DetailView, MyDetailView, DeleteEntitlementView,InvitationView +from .views import IndexView, DetailView, MyDetailView, DeleteEntitlementView,InvitationView, DeleteUserView urlpatterns = [ url(r'^all$', @@ -23,4 +23,7 @@ urlpatterns = [ url(r'^(?P[\w-]+)/entitlement/delete/(?P[\w-]+)$', DeleteEntitlementView.as_view(), name='users-delete-entitlement'), + url(r'^(?P[\w-]+)/delete$', + DeleteUserView.as_view(), + name='users-delete-user'), ] diff --git a/apimanager/users/views.py b/apimanager/users/views.py index e56cc4d..6a37b89 100644 --- a/apimanager/users/views.py +++ b/apimanager/users/views.py @@ -343,3 +343,35 @@ class DeleteEntitlementView(LoginRequiredMixin, View): redirect_url = reverse('users-index') return HttpResponseRedirect(redirect_url) + + +class DeleteUserView(LoginRequiredMixin, View): + """View to delete a user""" + + def post(self, request, *args, **kwargs): + """Deletes a user via API""" + api = API(self.request.session.get('obp')) + try: + urlpath = '/users/{}'.format( + kwargs['user_id']) + result = api.delete(urlpath) + if result is not None and 'code' in result and result['code'] >= 400: + messages.error(request, result['message']) + else: + msg = 'User with ID {} has been deleted.'.format(kwargs['user_id']) + messages.success(request, msg) + except APIError as err: + messages.error(request, err) + except: + messages.error(self.request, 'Unknown Error') + + # from sonarcloud: Change this code to not perform redirects based on user-controlled data. + redirect_url_from_gui = request.POST.get('next', reverse('users-index')) + if "/users/all/user_id/" in str(redirect_url_from_gui): + redirect_url = reverse('users-detail', kwargs={"user_id": kwargs['user_id']}) + elif ("/users/myuser/user_id/" in str(redirect_url_from_gui)): + redirect_url = reverse('my-user-detail', kwargs={"user_id": kwargs['user_id']}) + else: + redirect_url = reverse('users-index') + + return HttpResponseRedirect(redirect_url)