diff --git a/packages/builder/src/pages/builder/portal/manage/users/[userId].svelte b/packages/builder/src/pages/builder/portal/manage/users/[userId].svelte
index 3e7c64dbec..0f697a5007 100644
--- a/packages/builder/src/pages/builder/portal/manage/users/[userId].svelte
+++ b/packages/builder/src/pages/builder/portal/manage/users/[userId].svelte
@@ -237,18 +237,21 @@
-
-
-
-
-
-
-
-
-
+ {#if userId !== $auth.user._id}
+
+
+
+
+
+
+
+
+
+ {/if}
diff --git a/packages/builder/src/pages/builder/portal/manage/users/index.svelte b/packages/builder/src/pages/builder/portal/manage/users/index.svelte
index d18881d1bb..b6cac9ece3 100644
--- a/packages/builder/src/pages/builder/portal/manage/users/index.svelte
+++ b/packages/builder/src/pages/builder/portal/manage/users/index.svelte
@@ -28,6 +28,7 @@
import ImportUsersModal from "./_components/ImportUsersModal.svelte"
import { createPaginationStore } from "helpers/pagination"
import { Constants } from "@budibase/frontend-core"
+ import { get } from "svelte/store"
const accessTypes = [
{
@@ -198,6 +199,10 @@
const deleteRows = async () => {
try {
let ids = selectedRows.map(user => user._id)
+ if (ids.includes(get(auth).user._id)) {
+ notifications.error("You cannot delete yourself")
+ return
+ }
await users.bulkDelete(ids)
notifications.success(`Successfully deleted ${selectedRows.length} rows`)
selectedRows = []
diff --git a/packages/worker/src/api/controllers/global/users.ts b/packages/worker/src/api/controllers/global/users.ts
index 17e655edb3..30bf78efc6 100644
--- a/packages/worker/src/api/controllers/global/users.ts
+++ b/packages/worker/src/api/controllers/global/users.ts
@@ -3,17 +3,18 @@ import { checkInviteCode } from "../../../utilities/redis"
import { sendEmail } from "../../../utilities/email"
import { users } from "../../../sdk"
import env from "../../../environment"
-import { User, CloudAccount } from "@budibase/types"
+import { CloudAccount, User } from "@budibase/types"
import {
- events,
- errors,
accounts,
- users as usersCore,
- tenancy,
cache,
+ errors,
+ events,
+ tenancy,
+ users as usersCore,
} from "@budibase/backend-core"
import { checkAnyUserExists } from "../../../utilities/users"
import { groups as groupUtils } from "@budibase/pro"
+
const MAX_USERS_UPLOAD_LIMIT = 1000
export const save = async (ctx: any) => {
@@ -117,8 +118,7 @@ export const adminUser = async (ctx: any) => {
export const countByApp = async (ctx: any) => {
const appId = ctx.params.appId
try {
- const response = await users.countUsersByApp(appId)
- ctx.body = response
+ ctx.body = await users.countUsersByApp(appId)
} catch (err: any) {
ctx.throw(err.status || 400, err)
}
@@ -126,6 +126,9 @@ export const countByApp = async (ctx: any) => {
export const destroy = async (ctx: any) => {
const id = ctx.params.id
+ if (id === ctx.user._id) {
+ ctx.throw(400, "Unable to delete self.")
+ }
await users.destroy(id, ctx.user)
@@ -136,6 +139,10 @@ export const destroy = async (ctx: any) => {
export const bulkDelete = async (ctx: any) => {
const { userIds } = ctx.request.body
+ if (userIds?.indexOf(ctx.user._id) !== -1) {
+ ctx.throw(400, "Unable to delete self.")
+ }
+
try {
let usersResponse = await users.bulkDelete(userIds)