diff --git a/advlabdb/adminModelViews.py b/advlabdb/adminModelViews.py index 7c898e4..2d9c01b 100644 --- a/advlabdb/adminModelViews.py +++ b/advlabdb/adminModelViews.py @@ -169,6 +169,8 @@ class UserView(SecureAdminModelView): if not is_created: if model == current_user and not form.active.data: raise ModelViewException("Tried to deactiavte yourself as user!") + if not model.has_role("admin"): + raise ModelViewException("Tried to remove your admin role!") if hasattr(form, "generate_new_password") and form.generate_new_password.data: password = randomPassword()