From 7ae8a1939a73ad5c6e52cc5c799f001a3fe00845 Mon Sep 17 00:00:00 2001
From: augustin64 <me.git@augustin64.fr>
Date: Wed, 28 Feb 2024 23:59:14 +0100
Subject: [PATCH] config: add DISABLE_ACCOUNT_DELETION

---
 default_config.py                            | 3 +++
 partitioncloud/modules/admin.py              | 3 ++-
 partitioncloud/modules/settings.py           | 7 ++++++-
 partitioncloud/templates/settings/index.html | 7 ++++---
 4 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/default_config.py b/default_config.py
index 5a47fdb..23afc2d 100644
--- a/default_config.py
+++ b/default_config.py
@@ -14,6 +14,9 @@ MAX_ONLINE_QUERIES=3
 # Disable registration of new users via /auth/register (they can still be added by root)
 DISABLE_REGISTER=False
 
+# Disable account deletion for users (still possible for admins)
+DISABLE_ACCOUNT_DELETION=False
+
 # Front URL of the application (for QRCodes generation)
 BASE_URL="http://localhost:5000"
 
diff --git a/partitioncloud/modules/admin.py b/partitioncloud/modules/admin.py
index ee78647..1e9c72a 100644
--- a/partitioncloud/modules/admin.py
+++ b/partitioncloud/modules/admin.py
@@ -50,7 +50,8 @@ def user_inspect(user_id):
         "settings/index.html",
         skip_old_password=True,
         inspected_user=inspected_user,
-        user=current_user
+        user=current_user,
+        deletion_allowed=True
     )
 
 
diff --git a/partitioncloud/modules/settings.py b/partitioncloud/modules/settings.py
index cf7fcb2..fa35516 100644
--- a/partitioncloud/modules/settings.py
+++ b/partitioncloud/modules/settings.py
@@ -27,7 +27,8 @@ def index():
     return render_template(
         "settings/index.html",
         inspected_user=user,
-        user=user
+        user=user,
+        deletion_allowed=not current_app.config["DISABLE_ACCOUNT_DELETION"]
     )
 
 
@@ -48,6 +49,10 @@ def delete_account():
         if cur_user.id != mod_user.id:
             flash(_("Missing rights."))
             return redirect(request.referrer)
+
+        if current_app.config["DISABLE_ACCOUNT_DELETION"]:
+            flash(_("You are not allowed to delete your account."))
+            return redirect(request.referrer)
     else:
         log_data = [mod_user.username, mod_user.id, cur_user.username]
 
diff --git a/partitioncloud/templates/settings/index.html b/partitioncloud/templates/settings/index.html
index 5de2603..7f50216 100644
--- a/partitioncloud/templates/settings/index.html
+++ b/partitioncloud/templates/settings/index.html
@@ -35,8 +35,9 @@
     <input type="hidden" id="user_id" name="user_id" value="{{ inspected_user.id }}">
     <input type="Submit" value="{{ _('confirm') }}">
 </form>
-
-<h3>{{ _("Delete account") }}</h3>
-<a href="#delete-account"><button class="red-confirm">{{ _("Delete account") }}</button></a>
+{% if deletion_allowed %}
+  <h3>{{ _("Delete account") }}</h3>
+  <a href="#delete-account"><button class="red-confirm">{{ _("Delete account") }}</button></a>
+{% endif %}
 
 {% endblock %}