Add check to forbid self vote delegation

openslides_backend/action/actions/meeting_user/set_data.py

@@ -56,6 +56,14 @@ def update_instance(self, instance: Dict[str, Any]) -> Dict[str, Any]:
                 ), "Not permitted to change user_id."
         elif meeting_id and user_id:
             instance["id"] = self.create_or_get_meeting_user(meeting_id, user_id)
+        if (
+            instance.get("vote_delegated_to_id")
+            and instance["vote_delegated_to_id"] == instance["id"]
+            or instance.get("vote_delegations_from_ids")
+            and instance["id"] in instance["vote_delegations_from_ids"]
+        ):
+            raise ActionException("Self vote delegation is not allowed.")
+
         return instance
 
     def get_meeting_id(self, instance: Dict[str, Any]) -> int:

tests/system/action/user/test_update.py

@@ -251,6 +251,41 @@ def test_update_vote_weight(self) -> None:
             },
         )
 
+    def test_update_self_vote_delegation(self) -> None:
+        self.set_models(
+            {
+                "user/111": {"username": "username_srtgb123", "meeting_user_ids": [11]},
+                "meeting_user/11": {"meeting_id": 1, "user_id": 111},
+                "meeting/1": {
+                    "name": "test_meeting_1",
+                    "is_active_in_organization_id": 1,
+                },
+            }
+        )
+        response = self.request(
+            "user.update", {"id": 111, "vote_delegated_to_id": 11, "meeting_id": 1}
+        )
+        self.assert_status_code(response, 400)
+        assert "Self vote delegation is not allowed." in response.json["message"]
+
+    def test_update_self_vote_delegation_2(self) -> None:
+        self.set_models(
+            {
+                "user/111": {"username": "username_srtgb123", "meeting_user_ids": [11]},
+                "meeting_user/11": {"meeting_id": 1, "user_id": 111},
+                "meeting/1": {
+                    "name": "test_meeting_1",
+                    "is_active_in_organization_id": 1,
+                },
+            }
+        )
+        response = self.request(
+            "user.update",
+            {"id": 111, "vote_delegations_from_ids": [11], "meeting_id": 1},
+        )
+        self.assert_status_code(response, 400)
+        assert "Self vote delegation is not allowed." in response.json["message"]
+
     def test_committee_manager_without_committee_ids(self) -> None:
         """Giving committee management level requires committee_ids"""
         self.set_models(