From db4ffe79798ff292d35445466a8f04c0d6b5e7e0 Mon Sep 17 00:00:00 2001
From: PCoder <purple.coder@yahoo.co.uk>
Date: Sun, 24 Feb 2019 17:45:39 +0100
Subject: [PATCH] Use LdapManager delete_user to delete the user's account

---
 dal/views.py | 39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/dal/views.py b/dal/views.py
index e03a634..4c76c13 100644
--- a/dal/views.py
+++ b/dal/views.py
@@ -379,24 +379,27 @@ class DeleteAccount(View):
 
         # Does the user exist?
         username = request.POST.get('username')
-        if not check_user_exists(username):
-            return render(request, 'error.html', { 'urlname': urlname, 'service': service, 'error': 'Unknown user.' } )
-
-        # Do user and password match?
-        password = request.POST.get('password')
-        pwd = r'%s' % password
-        check = authenticate(request, username=username, password=pwd)
-        if check is None:
-            return render(request, 'error.html', { 'urlname': urlname, 'service': service, 'error': 'Wrong password for user.' } )
-
-        # Try to delete the user
-        with get_pool().next() as rpc:
-            result = rpc.deleteuser.delete_user(username)
-        # User deleted
-        if result == True:
-            logout(request)
-            return render(request, 'deleteduser.html', { 'user': username } )
-        # User not deleted, got some kind of error
+        ldap_manager = LdapManager()
+        user_exists, user_details = ldap_manager.check_user_exists(username)
+        if user_exists and request.user.username == username:
+            # Do user and password match?
+            password = request.POST.get('password')
+            pwd = r'%s' % password
+            check = authenticate(request, username=username, password=pwd)
+            if check is None:
+                return render(request, 'error.html',
+                              {'urlname': urlname, 'service': service,
+                               'error': 'Wrong password for user.'})
+            result = ldap_manager.delete_user(username)
+            # User deleted
+            if result:
+                logout(request)
+                return render(request, 'deleteduser.html', {'user': username})
+            # User not deleted, got some kind of error
+            else:
+                return render(request, 'error.html',
+                              {'urlname': urlname, 'service': service,
+                               'error': result})
         else:
             return render(request, 'error.html', { 'urlname': urlname, 'service': service, 'error': result } )