Skip to content

Command to create an admin should bail if the user exists and is not a superuser #427

@cdriehuys

Description

@cdriehuys

What problem does your proposed feature solve?
If a situation arises where the email address of the admin to create has already been used, the current behavior is to blindly update that user to a superuser and set their password to an admin.

Describe the solution you'd like
It does not make sense to upgrade an existing user if they are not already a staff user. If they are not a staff user we are both upgrading their permissions, potentially creating a security hole, and changing their password without their knowledge/consent. The command should bail if the email exists and the associated user is not a staff user.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions