diff --git a/src/postorius/views/list.py b/src/postorius/views/list.py index 76197e2..ad5c2e0 100644 --- a/src/postorius/views/list.py +++ b/src/postorius/views/list.py @@ -837,7 +837,8 @@ context_instance=RequestContext(request)) -@user_passes_test(lambda u: u.is_superuser) +@login_required +@list_owner_required def remove_role(request, list_id=None, role=None, address=None, template='postorius/lists/confirm_remove_role.html'): """Removes a list moderator or owner. @@ -852,6 +853,10 @@ messages.error(request, _('The user {} is not an owner'.format(address))) return redirect("list_members", the_list.list_id) + user_addresses = set([request.user.email]) | set(user.other_emails) + if address in user_addresses: + messages.error(request, _('You cannot remove yourself.')) + return redirect("list_members", the_list.list_id) elif role == 'moderator': if address not in the_list.moderators: messages.error(request,