Skip to content

Command to create an admin should bail if the user exists and is not a superuser #427

Description

@cdriehuys

What problem does your proposed feature solve?
If a situation arises where the email address of the admin to create has already been used, the current behavior is to blindly update that user to a superuser and set their password to an admin.

Describe the solution you'd like
It does not make sense to upgrade an existing user if they are not already a staff user. If they are not a staff user we are both upgrading their permissions, potentially creating a security hole, and changing their password without their knowledge/consent. The command should bail if the email exists and the associated user is not a staff user.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions