From 4c588b3d5f8e659c93df2ffca4ab65342813b140 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Wed, 20 Feb 2008 23:24:39 -0500
Subject: [PATCH] Don't let a regular user edit their own active status or
 manager

433384
---
 ipa-server/ipa-gui/ipagui/templates/usereditform.kid | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
index 35b2e35c1..f64c31edb 100644
--- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
@@ -241,6 +241,9 @@ from ipagui.helpers import ipahelper
           <span py:replace="user_fields.nsAccountLock.display(value_for(user_fields.nsAccountLock))" />
           <span py:if="tg.errors.get('nsAccountLock')" class="fielderror"
                     py:content="tg.errors.get('nsAccountLock')" />
+          <script py:if="tg.identity.display_name == value.get('uid')" type="text/javascript">
+              document.getElementById('form_nsAccountLock').disabled = true;
+          </script>
         </td>
       </tr>
 
@@ -712,7 +715,7 @@ from ipagui.helpers import ipahelper
         <td valign="top">
           <div>
             <span id='manager_select_cn'>${value_for(user_fields.manager_cn)}</span>
-            <span id='manager_links'>
+            <span py:if="'editors' in tg.identity.groups or 'admins' in tg.identity.groups or tg.identity.display_name != value.get('uid')" id='manager_links'>
               <a href="#" onclick="return clearSelect('manager');">clear</a>
               <a href="#" onclick="return startSelect('manager');">change</a>
             </span>