Changeset 724 for trunk

Timestamp:

Nov 28, 2010, 12:10:31 PM (14 years ago)

Author:

gav

Message:

Add some logic to protect the system (no delete or edit) and admin (no delete) pseudo persons.

File:

• trunk/grails-app/controllers/PersonController.groovy (modified) (4 diffs)

trunk/grails-app/controllers/PersonController.groovy

@@ -94 +94 @@
             // Avoid self-delete.
             if (!(authPrincipal instanceof String) && authPrincipal.username == person.loginName) {
-                flash.message = "You cannot delete yourself, please login as another manager and try again."
+                flash.errorMessage = "You cannot delete yourself, please login as another manager and try again."
+                redirect(action:show,id:params.id)
+            }
+            else if ( person.id == 1L) {
+                flash.errorMessage = "You cannot delete the pseudo system person."
+                redirect(action:show,id:params.id)
+            }
+            else if ( person.id == 2L) {
+                flash.errorMessage = "You cannot delete the admin person."
                 redirect(action:show,id:params.id)
             }
@@ -115 +123 @@
         }
         else {
-            flash.message = "Person not found with id $params.id"
+            flash.errorMessage = "Person not found with id $params.id"
         }
     }
@@ -131 +139 @@
             return
         }
+
+        if ( person.id == 1L) {
+            flash.errorMessage = "You cannot edit the pseudo system person."
+            redirect(action:show,id:params.id)
+            return
+        }
+
         params.message = "To allow login at least the 'ROLE_AppUser' authority must be given."
         return buildPersonModel(person)
@@ -152 +167 @@
                 person.errors.rejectValue 'version', "default.optimistic.locking.failure"
                 render view: 'edit', model: buildPersonModel(person)
+                return
+            }
+
+            if ( person.id == 1L) {
+                flash.errorMessage = "You cannot edit the pseudo system person."
+                redirect(action:show,id:params.id)
                 return
             }