762234 - Prevent deleting UserProfiles from admin

Status: VERIFIED FIXED

(Participation Infrastructure :: Phonebook, defect)

Description

[James Socol [:jsocol, :james]]

Right now you can delete a UserProfile via the admin. We probably don't want to make that possible unless you delete the User associated, but I'm not 100% sure?

So, thoughts? We can pretty-easily disallow that.

Comment 1

[Aakash Desai [:aakashd]]

+1

Comment 2

[James Socol [:jsocol, :james]]

I have a little time right now, just going to throw this in.

Comment 3

[[github robot]]

Commit pushed to master at https://github.com/mozilla/mozillians

https://github.com/mozilla/mozillians/commit/afabbbbae7c54d23e70a43a1b415246dfe9f4581
[fix bug 762234] Prevent deleting UserProfiles.

UserProfile objects shouldn't be deleted via the admin, they should
only be deleted by deleting the associated user.

Comment 4

[Matt Brandt [:mbrandt]]

Is the expected behavior that a tumble-beast is summoned if an admin attempts to delete a user profile? If it is I'm happy to mark this verified. I realize our 403 tumble-beast isn't very informative and in this instance the user is an administrator/expert user.

Steps to reproduce:
1. goto https://mozillians.allizom.org/en-US/admin/users/userprofile/
2. select a profile and delete it

What I expected:
A user friendly tumble-beast informs the admin that they are not allowed to do this action

Actual:
A generic tumble-beast informs the user "We're Sorry, but Something Went Wrong!"
[14:20:47.634] POST https://mozillians.allizom.org/en-US/admin/users/userprofile/ [HTTP/1.1 403 FORBIDDEN 124ms]

Comment 5

[Matt Brandt [:mbrandt]]

Attachment: qa - screenshot of 403 error page

Comment 6

[James Socol [:jsocol, :james]]

Matt, can you give me a little more detail in the STR?

Did you:
1) Click on a profile, and look for a Delete button (which, afaict, is missing). Or
2) Select a profile, and use the "delete" action from the menu?

Comment 7

[Matt Brandt [:mbrandt]]

Attachment: qa - str

(In reply to James Socol [:jsocol, :james] from comment #6)
> Matt, can you give me a little more detail in the STR?
> 
> Did you:
> 1) Click on a profile, and look for a Delete button (which, afaict, is
> missing). Or
> 2) Select a profile, and use the "delete" action from the menu?

Good point - I didn't realize there was a difference.

STR:
1. goto https://mozillians.allizom.org/en-US/admin/users/userprofile/
2. select a userprofile
3. from the action menu select 'Delete selected user profiles'

Comment 8

[James Socol [:jsocol, :james]]

Ah, yes, we need to remove the 'delete' bulk action. I've done this before, but at least deletes are prevented right now.

Mind filling a follow-up to remove the bulk action? You can go ahead and assign to me. I don't call it a blocker her because the action itself is prevented, it's just kind of annoying.

Comment 9

[Matt Brandt [:mbrandt]]

Thanks James for helping with clarification. I've filed bug 764183 to capture your suggestion (comment 8) - bumping this bug to QA verified