diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 257aaae..6550c67 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -63,6 +63,7 @@ class UsersController < ApplicationController def update raise AccessError unless @user.can_update? cuser + params[:user].delete(:username) unless @user.can_change_name? cuser if @user.update_attributes params[:user] flash[:notice] = t(:users_update) redirect_to_back diff --git a/app/models/user.rb b/app/models/user.rb index 5110deb..12554f6 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -271,6 +271,10 @@ class User < ActiveRecord::Base cuser and (self == cuser or cuser.admin?) end + def can_change_name? cuser + cuser and cuser.admin? + end + def can_destroy? cuser cuser and cuser.admin? end diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb index 752f357..b4fcba7 100644 --- a/app/views/users/edit.html.erb +++ b/app/views/users/edit.html.erb @@ -15,10 +15,12 @@
+ <% if cuser and @user.can_change_name? cuser %>
<%= f.label :username, 'Username', class: 'required' %> <%= f.text_field :username %>
+ <% end %>
<%= f.label :raw_password, "Password" %> <%= f.password_field :raw_password %>