fix: Check non-deleted events before user deletion (#7448)

fossasia · Nov 15, 2020 · e631f57 · e631f57
1 parent af5d617
commit e631f57
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/app/api/users.py b/app/api/users.py
@@ -276,7 +276,13 @@ def before_update_object(self, user, data, view_kwargs):
         if data.get('deleted_at') != user.deleted_at:
             if has_access('is_user_itself', user_id=user.id) or has_access('is_admin'):
                 if data.get('deleted_at'):
-                    if len(user.events) != 0:
+                    event_exists = db.session.query(
+                        Event.query.filter_by(deleted_at=None)
+                        .join(Event.users)
+                        .filter(User.id == user.id)
+                        .exists()
+                    ).scalar()
+                    if event_exists:
                         raise ForbiddenError(
                             {'source': ''},
                             "Users associated with events cannot be deleted",