Merge pull request DefectDojo#856 from devGregA/master

devGregA · web-flow · commit cce053272650 · 2019-01-28T10:29:22.000-06:00
Fixes permission issue
diff --git a/dojo/user/views.py b/dojo/user/views.py
@@ -209,7 +209,7 @@ def user(request):
                    })
 
 
-@user_passes_test(lambda u: u.is_staff)
+@user_passes_test(lambda u: u.is_superuser)
 def add_user(request):
     form = AddDojoUserForm()
     if not request.user.is_superuser:
@@ -252,7 +252,7 @@ def add_user(request):
         'to_add': True})
 
 
-@user_passes_test(lambda u: u.is_staff)
+@user_passes_test(lambda u: u.is_superuser)
 def edit_user(request, uid):
     user = get_object_or_404(Dojo_User, id=uid)
     authed_products = Product.objects.filter(authorized_users__in=[user])
@@ -303,7 +303,7 @@ def edit_user(request, uid):
         'to_edit': user})
 
 
-@user_passes_test(lambda u: u.is_staff)
+@user_passes_test(lambda u: u.is_superuser)
 def delete_user(request, uid):
     user = get_object_or_404(Dojo_User, id=uid)
     form = DeleteUserForm(instance=user)
