[fix] Disable PUT for user api, deny empty email (#1513)

HumanSignal · Sep 23, 2021 · eb75e18 · eb75e18
1 parent 5f370b5
commit eb75e18
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/label_studio/users/api.py b/label_studio/users/api.py
@@ -15,6 +15,7 @@
 from rest_framework.decorators import action
 from rest_framework import generics
 from rest_framework.permissions import IsAuthenticated
+from rest_framework.exceptions import MethodNotAllowed
 
 from core.permissions import all_permissions, ViewClassPermission
 from users.models import User
@@ -90,7 +91,7 @@ def avatar(self, request, pk):
             return Response(status=204)
 
     def update(self, request, *args, **kwargs):
-        return super(UserAPI, self).update(request, *args, **kwargs)
+        raise MethodNotAllowed('PUT')
 
     def list(self, request, *args, **kwargs):
         return super(UserAPI, self).list(request, *args, **kwargs)

diff --git a/label_studio/users/models.py b/label_studio/users/models.py
@@ -81,7 +81,7 @@ class User(UserMixin, AbstractBaseUser, PermissionsMixin, UserLastActivityMixin)
 
     Username and password are required. Other fields are optional.
     """
-    username = models.CharField(_('username'), max_length=256, blank=True)
+    username = models.CharField(_('username'), max_length=256)
     email = models.EmailField(_('email address'), unique=True, blank=True)
 
     first_name = models.CharField(_('first name'), max_length=256, blank=True)