github-jwinterm/modoboa
1
0
Fork 0
mirror of https://github.com/jwinterm/modoboa.git synced 2026-10-18 05:51:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Don't give access to super admins!!

Browse Source 
fixes #394
This commit is contained in:
Antoine Nguyen
2013-04-15 19:54:02 +02:00
parent d1353678ff
commit 465d9130d0
3 changed files with 30 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modoboa/admin/fixtures/test_content.json
+1 -1
View File
@@ -1 +1 @@
[{"pk": 2, "model": "admin.user", "fields": {"username": "user@test.com", "is_active": "True", "is_superuser": "False", "password": "{PLAIN}toto", "groups": [2]}},{"pk": 3, "model": "admin.user", "fields": {"username": "admin@test.com", "is_active": "True", "is_superuser": "False", "password": "{PLAIN}toto", "groups": [1]}},{"pk": 1, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 2, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 1, "model": "admin.Domain", "fields": {"name" : "test.com", "quota" : "100", "dates": "1"}}, {"pk": 1, "model": "admin.Mailbox", "fields": {"address": "user", "domain": "1", "dates": "1", "quota": "10", "user": "2"}}, {"pk": 2, "model": "admin.Mailbox", "fields": {"address": "admin", "domain": "1", "dates": "2", "quota": "10", "user": "3"}}]
[{"pk": 2, "model": "admin.user", "fields": {"username": "user@test.com", "is_active": "True", "is_superuser": "False", "password": "{PLAIN}toto", "groups": [2]}},{"pk": 3, "model": "admin.user", "fields": {"username": "admin@test.com", "is_active": "True", "is_superuser": "False", "password": "{PLAIN}toto", "groups": [1]}},{"pk": 4, "model": "admin.user", "fields": {"username": "superadmin@test.com", "is_active": "True", "is_superuser": "True", "password": "{PLAIN}toto", "groups": []}},{"pk": 1, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 2, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 3, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 1, "model": "admin.Domain", "fields": {"name" : "test.com", "quota" : "100", "dates": "1"}}, {"pk": 1, "model": "admin.Mailbox", "fields": {"address": "user", "domain": "1", "dates": "1", "quota": "10", "user": "2"}}, {"pk": 2, "model": "admin.Mailbox", "fields": {"address": "admin", "domain": "1", "dates": "2", "quota": "10", "user": "3"}}, {"pk": 3, "model": "admin.Mailbox", "fields": {"address": "superadmin", "domain": "1", "dates": "3", "quota": "10", "user": "4"}}, {"pk": "user@test.com", "model": "admin.Quota", "fields": {"username": "user@test.com", "bytes": 0, "messages": 0}}, {"pk": "admin@test.com", "model": "admin.Quota", "fields": {"username": "admin@test.com", "bytes": 0, "messages": 0}}, {"pk": "superadmin@test.com", "model": "admin.Quota", "fields": {"username": "superadmin@test.com", "bytes": 0, "messages": 0}}]
modoboa/admin/forms.py
+8 -4
View File
@@ -563,7 +563,11 @@ class AccountFormMail(forms.Form, DynamicForm):
owner=user)
grant_access_to_object(user, self.mb, is_owner=True)
events.raiseEvent("CreateMailbox", user, self.mb)
if user.is_superuser:
if user.is_superuser and not self.mb.user.is_superuser:
# A super user is creating a new mailbox. Give
# access to that mailbox (and the associated
# account) to the appropriate domain admins,
# except if the new account is super user.
for admin in self.mb.domain.admins:
grant_access_to_object(admin, self.mb)
grant_access_to_object(admin, self.mb.user)
@@ -572,9 +576,9 @@ class AccountFormMail(forms.Form, DynamicForm):
old_mail_home = None
if self.cleaned_data["email"] != self.mb.full_address:
old_mail_home = self.mb.mail_home
q = Quota.objects.get(username=self.mb.full_address)
self.mb.domain = domain
self.mb.address = locpart
q = Quota.objects.get(username=self.mb.full_address)
q.username = self.mb.full_address
q.save()
self.mb.set_quota(self.cleaned_data["quota"], user.has_perm("admin.add_domain"))
@@ -658,7 +662,7 @@ class AccountPermissionsForm(forms.Form, DynamicForm):
if not value in current_domains:
domain = Domain.objects.get(name=value)
grant_access_to_object(self.account, domain)
for mb in domain.mailbox_set.all():
for mb in domain.mailbox_set.filter(user__is_superuser=False).all():
grant_access_to_object(self.account, mb)
grant_access_to_object(self.account, mb.user)
for al in Alias.objects.filter(domain=domain):
@@ -668,7 +672,7 @@ class AccountPermissionsForm(forms.Form, DynamicForm):
if not len(filter(lambda name: self.cleaned_data[name] == domain.name,
self.cleaned_data.keys())):
ungrant_access_to_object(domain, self.account)
for mb in domain.mailbox_set.all():
for mb in domain.mailbox_set.filter(user__is_superuser=False).all():
ungrant_access_to_object(mb, self.account)
ungrant_access_to_object(mb.user, self.account)
for al in Alias.objects.filter(domain=domain):
modoboa/admin/tests.py
+21 -2
View File
@@ -89,7 +89,7 @@ class AccountTestCase(ModoTestCase):
self.assertTrue(account.check_password("toto"))
self.assertEqual(account.first_name, "Tester")
self.assertEqual(account.last_name, "Toto")
self.assertEqual(mb.domain.mailbox_count, 3)
self.assertEqual(mb.domain.mailbox_count, 4)
values["email"] = "pouet@test.com"
self.check_ajax_post(reverse("modoboa.admin.views.editaccount", args=[account.id]), values)
@@ -258,6 +258,25 @@ class PermissionsTestCase(ModoTestCase):
HTTP_X_REQUESTED_WITH='XMLHttpRequest')
self.assertNotEqual(response["Content-Type"], "application/json")
def test_domainadmin_deletes_superadmin(self):
"""Check domain admins restrictions about super admins
When a super admin owns a mailbox and a domain admin exists
for the associated domain, this domain admin must not be able
to access the super admin.
"""
values = dict(username="superadmin2@test.com", first_name="Super", last_name="Admin",
password1="toto", password2="toto", role="SuperAdmins",
is_active=True, email="superadmin@test.com", stepid=2)
self.check_ajax_post(reverse("modoboa.admin.views.newaccount"), values)
account = User.objects.get(username="superadmin2@test.com")
self.clt.logout()
self.clt.login(username="admin@test.com", password="toto")
self.check_ajax_get(reverse("modoboa.admin.views.delaccount") + "?selection=%d" \
% account.id, {},
status="ko", respmsg="Permission denied")
self.check_ajax_get(reverse("modoboa.admin.views.delaccount") + "?selection=%d" \
% 4, {},
status="ko", respmsg="Permission denied")