diff --git a/docs/usage.md b/docs/usage.md index ab71f16a1..c26d13fd3 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -252,7 +252,7 @@ permissions can be granted to limit access to certain parts of the UI (and corre #### Superusers -Superusers can access all parts of the front and backend application as well as any and all objects. +Superusers can access all parts of the front and backend application as well as any and all objects. Superuser status can only be granted by another superuser. #### Admin Status diff --git a/src/paperless/admin.py b/src/paperless/admin.py index 0ff506fe1..89575fe2e 100644 --- a/src/paperless/admin.py +++ b/src/paperless/admin.py @@ -5,6 +5,11 @@ from django.contrib.auth.models import User class PaperlessUserForm(forms.ModelForm): + """ + Custom form for the User model that adds validation to prevent non-superusers + from changing the superuser status of a user. + """ + class Meta: model = User fields = [