Prevent user from becoming admin in DELETE request (fossasia#5593)

abhinavk96 · web-flow · commit fcac2508ec8d · 2019-02-09T13:05:13.000+08:00
diff --git a/app/api/users.py b/app/api/users.py
@@ -208,7 +208,7 @@ def before_update_object(self, user, data, view_kwargs):
             else:
                 raise ConflictException({'pointer': '/data/attributes/email'}, "Email already exists")
 
-        if has_access('is_super_admin') and data.get('is_admin') != user.is_admin:
+        if has_access('is_super_admin') and data.get('is_admin') and data.get('is_admin') != user.is_admin:
             user.is_admin = not user.is_admin
 
         if has_access('is_admin') and data.get('is_sales_admin') != user.is_sales_admin:
