diff --git a/app/routes/admin.py b/app/routes/admin.py
index 068b81e..f27dd09 100644
--- a/app/routes/admin.py
+++ b/app/routes/admin.py
@@ -414,16 +414,30 @@ def edit_user():
user = User.query.get_or_404(user_id)
# Get form data
+ username = request.form.get('username', '').strip()
role = request.form.get('role', 'user')
is_active = 'is_active' in request.form
password = request.form.get('password', '').strip()
+ if not username:
+ flash('Username cannot be empty.', 'danger')
+ return redirect(url_for('admin.index'))
+
if role not in ['user', 'admin']:
flash('Invalid role specified.', 'danger')
return redirect(url_for('admin.index'))
+ # Check if username is taken by another user
+ if username != user.username:
+ existing_user = User.query.filter_by(username=username).first()
+ if existing_user:
+ flash('Username already exists.', 'danger')
+ return redirect(url_for('admin.index'))
+
try:
# Update user
+ old_username = user.username
+ user.username = username
user.role = role
user.is_active_user = is_active
@@ -436,8 +450,9 @@ def edit_user():
db.session.commit()
- log_action(f"User '{user.username}' updated - Role: {role}, Active: {is_active}")
- flash(f'User "{user.username}" updated successfully.', 'success')
+ log_action(f"User '{old_username}' updated - Username: {username}, Role: {role}, Active: {is_active}" +
+ (", Password changed" if password else ""))
+ flash(f'User "{username}" updated successfully.', 'success')
except Exception as e:
db.session.rollback()
diff --git a/app/templates/admin/index.html b/app/templates/admin/index.html
index fa69822..314189e 100644
--- a/app/templates/admin/index.html
+++ b/app/templates/admin/index.html
@@ -151,12 +151,16 @@
{% if user.username != current_user.username %}
- |