fixes #299

Author: devEricA

dojo/user/views.py

@@ -161,6 +161,10 @@ def user(request):
 @user_passes_test(lambda u: u.is_staff)
 def add_user(request):
     form = AddDojoUserForm()
+    if not request.user.is_superuser:
+        form.fields['is_staff'].widget.attrs['disabled'] = True
+        form.fields['is_superuser'].widget.attrs['disabled'] = True
+        form.fields['is_active'].widget.attrs['disabled'] = True
     contact_form = UserContactInfoForm()
     user = None
 
@@ -202,6 +206,10 @@ def edit_user(request, uid):
     user = get_object_or_404(Dojo_User, id=uid)
     authed_products = Product.objects.filter(authorized_users__in=[user])
     form = AddDojoUserForm(instance=user, initial={'authorized_products': authed_products})
+    if not request.user.is_superuser:
+        form.fields['is_staff'].widget.attrs['disabled'] = True
+        form.fields['is_superuser'].widget.attrs['disabled'] = True
+        form.fields['is_active'].widget.attrs['disabled'] = True
     try:
         user_contact = UserContactInfo.objects.get(user=user)
     except UserContactInfo.DoesNotExist: