Always set ownership.

fixes #499

modoboa/core/models.py

@@ -236,9 +236,10 @@ class User(PermissionsMixin):
     def can_access(self, obj):
         """Check if the user can access a specific object
 
-        This function is recursive : if the given user hasn't got direct
-        access to this object and if he has got access other ``User``
-        objects, we check if one of those users owns the object.
+        This function is recursive: if the given user hasn't got
+        direct access to this object and if he has got access to other
+        ``User`` objects, we check if one of those users owns the
+        object.
 
         :param obj: a admin object
         :return: a boolean

modoboa/extensions/admin/tests/__init__.py

@@ -5,9 +5,10 @@ from .alias import AliasTestCase
 from .import_ import ImportTestCase
 from .export import ExportTestCase
 from .password_schemes import PasswordSchemesTestCase
+from .user import ForwardTestCase
 
 __all__ = [
     'DomainTestCase', 'DomainAliasTestCase', 'AccountTestCase',
     'PermissionsTestCase', 'AliasTestCase', 'ImportTestCase',
-    'ExportTestCase', 'PasswordSchemesTestCase'
+    'ExportTestCase', 'PasswordSchemesTestCase', 'ForwardTestCase'
 ]

modoboa/extensions/admin/tests/user.py

@@ -0,0 +1,26 @@
+from django.core.urlresolvers import reverse
+from modoboa.core.models import User
+from modoboa.lib.tests import ModoTestCase
+from modoboa.extensions.admin.factories import populate_database
+from modoboa.extensions.admin.models import Alias
+
+
+class ForwardTestCase(ModoTestCase):
+    fixtures = ['initial_users.json']
+
+    def setUp(self):
+        super(ForwardTestCase, self).setUp()
+        populate_database()
+
+    def test_forward_permissions(self):
+        self.clt.logout()
+        self.clt.login(username='user@test.com', password='toto')
+        self.ajax_post(
+            reverse('modoboa.extensions.admin.views.user.forward'),
+            {'dest': 'user@extdomain.com', 'keepcopies': True}
+        )
+        forward = Alias.objects.get(address='user', domain__name='test.com')
+        sadmin = User.objects.get(username='admin')
+        self.assertTrue(sadmin.can_access(forward))        
+        domadmin = User.objects.get(username='admin@test.com')
+        self.assertTrue(domadmin.can_access(forward))

modoboa/extensions/admin/views/user.py

@@ -31,9 +31,9 @@ def forward(request, tplname='admin/forward.html'):
             if form.cleaned_data["keepcopies"]:
                 intdests += [mb]
             form.parse_dest()
-            al.save(int_rcpts=intdests, ext_rcpts=form.dests)
-            if request.user.group != "SimpleUsers":
-                al.post_create(request.user)
+            al.save(
+                int_rcpts=intdests, ext_rcpts=form.dests, creator=request.user
+            )
             return render_to_json_response(_("Forward updated"))
 
         return render_to_json_response(