From b9a538aff0d468539c123b9beff799a1e10ae39c Mon Sep 17 00:00:00 2001
From: idafurjes <36131195+idafurjes@users.noreply.github.com>
Date: Mon, 23 Aug 2021 08:58:35 +0200
Subject: [PATCH] Bug: Add check before delete org (#38056)

* Add check before delete org

* Fix comment

* Simpify check if signed in user belongs to the org

* Add check on login if user has and existing org
change error code to 400, when org can not be deleted

* Roll back last commit, regarding an different issue
---
 pkg/api/org.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkg/api/org.go b/pkg/api/org.go
index 364a07e2d84..078e9c20d17 100644
--- a/pkg/api/org.go
+++ b/pkg/api/org.go
@@ -152,7 +152,13 @@ func updateOrgAddressHelper(form dtos.UpdateOrgAddressForm, orgID int64) respons
 
 // GET /api/orgs/:orgId
 func DeleteOrgByID(c *models.ReqContext) response.Response {
-	if err := bus.Dispatch(&models.DeleteOrgCommand{Id: c.ParamsInt64(":orgId")}); err != nil {
+	orgID := c.ParamsInt64(":orgId")
+	// before deleting an org, check if user does not belong to the current org
+	if c.OrgId == orgID {
+		return response.Error(400, "Can not delete org for current user", nil)
+	}
+
+	if err := bus.Dispatch(&models.DeleteOrgCommand{Id: orgID}); err != nil {
 		if errors.Is(err, models.ErrOrgNotFound) {
 			return response.Error(404, "Failed to delete organization. ID not found", nil)
 		}