#10 Cleaned up user alteration code. Stopped user being able to add arbitrary roles. Stopped logged in user from changing when updaing a given user account.

controllers/web/user.py

@@ -68,7 +68,7 @@ def display_update(id: int):
     db = UserController()
     user = db.read_id(id)
 
-    return render_template('index.html', content="user.html", user=user)
+    return render_template('index.html', content="user.html", updating_user=user)
 
 
 @blueprint.post('/update/<int:id>')
@@ -100,6 +100,14 @@ def update(id: int):
             "warning"
         )
         return redirect(url_for('main.users.display_update', id=id))
+    
+    # Invalid role submitted
+    if user.role not in ROLES:
+        flash(
+            f"Selected role, {user.role}, is not valid!",
+            "warning"
+        )
+        return redirect(url_for('main.users.display_update', id=id))
 
     db.update(user)