WHO_CAN_ANONYMIZE_ACCOUNTS

Fix for #943 .
ASKBOT · Aug 21, 2024 · 7ff779b · 7ff779b
1 parent ee5e4bd
commit 7ff779b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/askbot/models/__init__.py b/askbot/models/__init__.py
@@ -527,6 +527,11 @@ def user_has_badge(self, badge):
 def user_can_anonymize_account(self, user):
     """`True`, if `self` can anonymize and disable account of `user`"""
     perm = askbot_settings.WHO_CAN_ANONYMIZE_ACCOUNTS
+
+    # non-admins cannot remove admins or moderators
+    if not self.is_administrator() and user.is_administrator_or_moderator():
+        return False
+
     if perm == 'admins':
         return self.is_administrator() and self.pk != user.pk
     elif self.is_administrator_or_moderator():