diff --git a/apps/auth/service.py b/apps/auth/service.py index 824384fd5d..06099e6c58 100644 --- a/apps/auth/service.py +++ b/apps/auth/service.py @@ -130,9 +130,11 @@ def delete(self, lookup): if error_message: raise SuperdeskApiError.forbiddenError(message=error_message) - # Delete all the sessions + # Delete all the sessions except current session + current_session_id = auth.get_auth().get("_id") for session in sessions: - get_resource_service("auth").delete_action({config.ID_FIELD: str(session[config.ID_FIELD])}) + if str(session[config.ID_FIELD]) != str(current_session_id): + get_resource_service("auth").delete_action({config.ID_FIELD: str(session[config.ID_FIELD])}) # Check if any orphan session_preferences exist for the user if user.get("session_preferences"): @@ -146,13 +148,9 @@ def __can_clear_sessions(self, user): Operation is invalid if one of the below is True: 1. Check if the user exists. - 2. Check if the user is clearing his/her own sessions. :return: error message if invalid. """ if not user: return "Invalid user to clear sessions." - - if str(user[config.ID_FIELD]) == str(flask.g.user[config.ID_FIELD]): - return "Not allowed to clear your own sessions."