From 0ab1823d3aa9f4d53bf1aa70e894e3d336df161d Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Thu, 30 Jun 2011 18:31:55 +0200 Subject: [PATCH] Server-side protection to disallow domain admins to create inter-domains aliases. see #143 --- admin/forms.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/admin/forms.py b/admin/forms.py index 8e0799555..b3f298d18 100644 --- a/admin/forms.py +++ b/admin/forms.py @@ -1,6 +1,7 @@ # coding: utf-8 from django import forms from modoboa.admin.models import * +from modoboa.admin.lib import is_domain_admin from django.utils.translation import ugettext as _ from django.contrib.auth.models import User from modoboa.admin.templatetags.admin_extras import gender @@ -130,12 +131,20 @@ class AliasForm(ProxyForm): def set_targets(self, user, values): self.ext_targets = [] self.int_targets = [] + umb = Mailbox.objects.get(user=user.id) for addr in values: if addr == "": continue local_part, domain = split_mailbox(addr) if domain is None: raise AdminError("%s %s" % (_("Invalid mailbox"), addr)) + if is_domain_admin(user) and umb.domain.name != domain: + try: + d = Domain.objects.get(name=domain) + except Domain.DoesNotExist: + pass + else: + raise AdminError("%s %s" % (_("Access denied for"), addr)) try: mb = Mailbox.objects.get(address=local_part, domain__name=domain) except Mailbox.DoesNotExist: