diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 2fb297874..00ed9e685 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -184,6 +184,14 @@ class UsersController < ApplicationController end def destroy + if @user == User.current && !@user.own_account_deletable? + error_messages = @user.own_account_deletion_errors.full_messsages + respond_to do |format| + format.html { return render_error message: error_messages.join(', '), status: 422 } + format.api { return render_api_errors(error_messages) } + end + end + @user.destroy respond_to do |format| format.html { redirect_back_or_default(users_path) } diff --git a/app/models/user.rb b/app/models/user.rb index 9a073f1bd..1d62b326d 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -754,8 +754,22 @@ class User < Principal # Returns true if the user is allowed to delete the user's own account def own_account_deletable? - Setting.unsubscribe? && - (!admin? || User.active.admin.where("id <> ?", id).exists?) + own_account_deletion_errors.present? + end + + def own_account_deletion_errors + errors = ActiveModel::Errors.new(self) + + unless Setting.unsubscribe? + errors.add(:base, :error_unable_delete_own_account) + return errors + end + + if admin? && !User.active.admin.where("id <> ?", id).exists? + errors.add(:base, :error_unable_delete_last_active_admin) + end + + errors end safe_attributes(