From c38ce20a5d666e861b29fcce07ea80865ec7315d Mon Sep 17 00:00:00 2001 From: Lain Soykaf Date: Sun, 20 Jul 2025 21:33:39 +0400 Subject: [PATCH] AdminApiController: Reorder functions to fix admin revocation --- .../web/admin_api/controllers/admin_api_controller.ex | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/pleroma/web/admin_api/controllers/admin_api_controller.ex b/lib/pleroma/web/admin_api/controllers/admin_api_controller.ex index b35f5cdcd..ea852748e 100644 --- a/lib/pleroma/web/admin_api/controllers/admin_api_controller.ex +++ b/lib/pleroma/web/admin_api/controllers/admin_api_controller.ex @@ -240,6 +240,10 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do render_error(conn, :not_found, "No such permission_group") end + def right_delete(%{assigns: %{user: %{nickname: nickname}}} = conn, %{"nickname" => nickname}) do + render_error(conn, :forbidden, "You can't revoke your own admin status.") + end + def right_delete( %{assigns: %{user: admin}} = conn, %{ @@ -265,10 +269,6 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do json(conn, fields) end - def right_delete(%{assigns: %{user: %{nickname: nickname}}} = conn, %{"nickname" => nickname}) do - render_error(conn, :forbidden, "You can't revoke your own admin status.") - end - @doc "Get a password reset token (base64 string) for given nickname" def get_password_reset(conn, %{"nickname" => nickname}) do (%User{local: true} = user) = User.get_cached_by_nickname(nickname)