Prevent regular users from promoting themselves to admins

2 files changed, 6 insertions, 1 deletions

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index eb1cd4c..87df678 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -33,6 +33,7 @@ class UsersController < ApplicationController
   end
 
   def update
+    params[:user].delete(:admin) unless current_user.is_admin?
     if @user.update_attributes(params[:user])
       flash[:notice] = "Updated user #{@user.login}"
       redirect_to user_path(@user)
diff --git a/app/models/user.rb b/app/models/user.rb
index 035a145..ce5503f 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -79,7 +79,11 @@ class User < ActiveRecord::Base
     return false
   end
   
-    private
+  def is_admin?
+    !!admin
+  end
+  
+  private
     
     def set_permission(granted, node)    
       permission = self.permissions.for_node(node).first