From d96ebb3bdd64201bf6f353a90c4a53ae052c3f51 Mon Sep 17 00:00:00 2001
From: Angus McLeod <angus@mcleod.org.au>
Date: Tue, 14 Apr 2020 20:46:53 +1000
Subject: [PATCH] Don't allow auto-updating of trust level

---
 .../discourse/components/wizard-mapper-selector.js.es6       | 5 +++--
 lib/custom_wizard/actions.rb                                 | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/assets/javascripts/discourse/components/wizard-mapper-selector.js.es6 b/assets/javascripts/discourse/components/wizard-mapper-selector.js.es6
index b77f80f3..302949c8 100644
--- a/assets/javascripts/discourse/components/wizard-mapper-selector.js.es6
+++ b/assets/javascripts/discourse/components/wizard-mapper-selector.js.es6
@@ -84,13 +84,14 @@ export default Component.extend({
       content = content.filter(field => field.id !== controller.currentField.id);
     }
     
-    // updating usernames or emails via actions is not supported
+    // updating certain user fields via the profile update action is not supported
     if (activeType === 'userField' &&
         this.options.context === 'action' &&
         this.inputType === 'association' &&
         this.selectorType === 'key') {
       
-      content = content.filter(userField => ['username','email'].indexOf(userField.id) === -1);  
+      const excludedFields = ['username','email', 'trust_level'];
+      content = content.filter(userField => excludedFields.indexOf(userField.id) === -1);  
     }
     
     return content;
diff --git a/lib/custom_wizard/actions.rb b/lib/custom_wizard/actions.rb
index 2244abec..ff9f35c0 100644
--- a/lib/custom_wizard/actions.rb
+++ b/lib/custom_wizard/actions.rb
@@ -275,7 +275,7 @@ class CustomWizard::Action
   end
   
   def profile_excluded_fields
-    ['username', 'email'].freeze
+    ['username', 'email', 'trust_level'].freeze
   end
   
   def allowed_profile_fields