paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-10-23 04:52:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

api: Require can_create_users permission to create users via API.

Browse Source 
Allowing any admins to create arbitrary users is not ideal because it
can lead to abuse issues.  We should require something stronger that
requires the server operator's approval and thus we add a new
can_create_users permission.
This commit is contained in:
Mateusz Mandera
2020-12-14 22:02:22 +01:00
committed by Tim Abbott
parent c9b6d8ddad
commit 160cc5120a
11 changed files with 87 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tools/test-api
View File

@@ -47,6 +47,10 @@ with test_server_running(force=options.force, external_host='zulipdev.com:9981')
email = 'iago@zulip.com' # Iago is an admin
realm = get_realm('zulip')
user = get_user(email, realm)
# Required to test can_create_users endpoints.
user.can_create_users = True
user.save(update_fields=["can_create_users"])
api_key = get_api_key(user)
site = 'http://zulip.zulipdev.com:9981'
client = Client(