Prevent DeleteUser API abuse

[6543]

close #10119

[6543]

I think we should backport this ...

[6543]

I run in this trap while writing tests for the sdk ...

[jolheiser]

Small nits otherwise LGTM

[codecov-io]

Codecov Report

❗ No coverage uploaded for pull request base (master@29151b9). Click here to learn what that means.
The diff coverage is 0%.

@@            Coverage Diff            @@
##             master   #10125   +/-   ##
=========================================
  Coverage          ?    43.4%           
=========================================
  Files             ?      576           
  Lines             ?    79636           
  Branches          ?        0           
=========================================
  Hits              ?    34565           
  Misses            ?    40791           
  Partials          ?     4280

Impacted Files	Coverage Δ
routers/org/setting.go	0% <ø> (ø)
routers/api/v1/admin/user.go	30.19% <0%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 29151b9...fbc34ad. Read the comment docs.

[lafriks]

Please send backport

[6543]

done -> #10128

[lunny]

I think it's better to move the check into models.DeleteUser.

[6543]

should I send a refactor PR?

[guillep2k]

I think it's better to move the check into models.DeleteUser.

So orgs can't be deleted ever? 🤔

[6543]

@guillep2k Orgs have there own delete function:

gitea/models/org.go

Lines 257 to 275 in b3c72a7

	// DeleteOrganization completely and permanently deletes everything of organization.
	func DeleteOrganization(org *User) (err error) {
	sess := x.NewSession()
	defer sess.Close()
	if err = sess.Begin(); err != nil {
	return err
	}
	if err = deleteOrg(sess, org); err != nil {
	if IsErrUserOwnRepos(err) {
	return err
	} else if err != nil {
	return fmt.Errorf("deleteOrg: %v", err)
	}
	}
	return sess.Commit()
	}

to be exact it is here:

gitea/models/org.go

Lines 299 to 301 in b3c72a7

	if _, err = e.ID(u.ID).Delete(new(User)); err != nil {
	return fmt.Errorf("Delete: %v", err)
	}

[6543]

@lunny -> #10134