Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

check ENABLE_ACCOUNT_DELETION before account deletion #33681

Closed
wants to merge 6 commits into from
Closed

check ENABLE_ACCOUNT_DELETION before account deletion #33681

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8639ce9
fix(account-deletion): check ENABLE_ACCOUNT_DELETION before account d…
JonasBM Nov 8, 2023
b74d724
Merge branch 'openedx:master' into master
JonasBM Nov 9, 2023
41944f0
Merge branch 'master' into master
e0d Nov 9, 2023
696cf41
style: fix lint errors
JonasBM Nov 9, 2023
2f239ef
Merge branch 'master' into master
JonasBM Nov 9, 2023
377cf56
Merge branch 'master' into master
JonasBM Nov 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions openedx/core/djangoapps/user_api/accounts/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
from edx_ace import ace
from edx_ace.recipient import Recipient
from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
from openedx.core.djangoapps.site_configuration import helpers as configuration_helpers
from openedx.core.lib.api.authentication import BearerAuthentication
from edx_rest_framework_extensions.auth.session.authentication import SessionAuthenticationAllowInactiveUser
from enterprise.models import EnterpriseCourseEnrollment, EnterpriseCustomerUser, PendingEnterpriseCustomerUser
Expand Down Expand Up @@ -541,6 +542,9 @@ class DeactivateLogoutView(APIView):

**POST Response Values**

If account deletion is not enabled,
the request returns an HTTP 403 "Forbidden" response.

If the request does not specify a username or submits a username
for a non-existent user, the request returns an HTTP 404 "Not Found"
response.
Expand Down Expand Up @@ -572,6 +576,14 @@ def post(self, request):
Marks the user as having no password set for deactivation purposes,
and logs the user out.
"""

# Ensure that account deletion is enabled
enable_account_deletion = configuration_helpers.get_value(
'ENABLE_ACCOUNT_DELETION', settings.FEATURES.get('ENABLE_ACCOUNT_DELETION', False)
)
if enable_account_deletion is False:
return Response(status=status.HTTP_403_FORBIDDEN)

user_model = get_user_model()
try:
# Get the username from the request and check that it exists
Expand Down
Loading