diff --git a/modoboa/admin/fixtures/test_content.json b/modoboa/admin/fixtures/test_content.json index 0a7c82282..27301a1dc 100644 --- a/modoboa/admin/fixtures/test_content.json +++ b/modoboa/admin/fixtures/test_content.json @@ -1 +1 @@ -[{"pk": 2, "model": "admin.user", "fields": {"username": "user@test.com", "is_active": "True", "is_superuser": "False", "password": "{PLAIN}toto", "groups": [2]}},{"pk": 3, "model": "admin.user", "fields": {"username": "admin@test.com", "is_active": "True", "is_superuser": "False", "password": "{PLAIN}toto", "groups": [1]}},{"pk": 1, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 2, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 1, "model": "admin.Domain", "fields": {"name" : "test.com", "quota" : "100", "dates": "1"}}, {"pk": 1, "model": "admin.Mailbox", "fields": {"address": "user", "domain": "1", "dates": "1", "quota": "10", "user": "2"}}, {"pk": 2, "model": "admin.Mailbox", "fields": {"address": "admin", "domain": "1", "dates": "2", "quota": "10", "user": "3"}}] +[{"pk": 2, "model": "admin.user", "fields": {"username": "user@test.com", "is_active": "True", "is_superuser": "False", "password": "{PLAIN}toto", "groups": [2]}},{"pk": 3, "model": "admin.user", "fields": {"username": "admin@test.com", "is_active": "True", "is_superuser": "False", "password": "{PLAIN}toto", "groups": [1]}},{"pk": 4, "model": "admin.user", "fields": {"username": "superadmin@test.com", "is_active": "True", "is_superuser": "True", "password": "{PLAIN}toto", "groups": []}},{"pk": 1, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 2, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 3, "model": "admin.ObjectDates", "fields": {"creation": "2011-09-07 09:27:07.579603", "last_modification": "2011-09-07 09:27:07.579603"}}, {"pk": 1, "model": "admin.Domain", "fields": {"name" : "test.com", "quota" : "100", "dates": "1"}}, {"pk": 1, "model": "admin.Mailbox", "fields": {"address": "user", "domain": "1", "dates": "1", "quota": "10", "user": "2"}}, {"pk": 2, "model": "admin.Mailbox", "fields": {"address": "admin", "domain": "1", "dates": "2", "quota": "10", "user": "3"}}, {"pk": 3, "model": "admin.Mailbox", "fields": {"address": "superadmin", "domain": "1", "dates": "3", "quota": "10", "user": "4"}}, {"pk": "user@test.com", "model": "admin.Quota", "fields": {"username": "user@test.com", "bytes": 0, "messages": 0}}, {"pk": "admin@test.com", "model": "admin.Quota", "fields": {"username": "admin@test.com", "bytes": 0, "messages": 0}}, {"pk": "superadmin@test.com", "model": "admin.Quota", "fields": {"username": "superadmin@test.com", "bytes": 0, "messages": 0}}] diff --git a/modoboa/admin/forms.py b/modoboa/admin/forms.py index 2d26e8c90..f225afe18 100644 --- a/modoboa/admin/forms.py +++ b/modoboa/admin/forms.py @@ -563,7 +563,11 @@ class AccountFormMail(forms.Form, DynamicForm): owner=user) grant_access_to_object(user, self.mb, is_owner=True) events.raiseEvent("CreateMailbox", user, self.mb) - if user.is_superuser: + if user.is_superuser and not self.mb.user.is_superuser: + # A super user is creating a new mailbox. Give + # access to that mailbox (and the associated + # account) to the appropriate domain admins, + # except if the new account is super user. for admin in self.mb.domain.admins: grant_access_to_object(admin, self.mb) grant_access_to_object(admin, self.mb.user) @@ -572,9 +576,9 @@ class AccountFormMail(forms.Form, DynamicForm): old_mail_home = None if self.cleaned_data["email"] != self.mb.full_address: old_mail_home = self.mb.mail_home + q = Quota.objects.get(username=self.mb.full_address) self.mb.domain = domain self.mb.address = locpart - q = Quota.objects.get(username=self.mb.full_address) q.username = self.mb.full_address q.save() self.mb.set_quota(self.cleaned_data["quota"], user.has_perm("admin.add_domain")) @@ -658,7 +662,7 @@ class AccountPermissionsForm(forms.Form, DynamicForm): if not value in current_domains: domain = Domain.objects.get(name=value) grant_access_to_object(self.account, domain) - for mb in domain.mailbox_set.all(): + for mb in domain.mailbox_set.filter(user__is_superuser=False).all(): grant_access_to_object(self.account, mb) grant_access_to_object(self.account, mb.user) for al in Alias.objects.filter(domain=domain): @@ -668,7 +672,7 @@ class AccountPermissionsForm(forms.Form, DynamicForm): if not len(filter(lambda name: self.cleaned_data[name] == domain.name, self.cleaned_data.keys())): ungrant_access_to_object(domain, self.account) - for mb in domain.mailbox_set.all(): + for mb in domain.mailbox_set.filter(user__is_superuser=False).all(): ungrant_access_to_object(mb, self.account) ungrant_access_to_object(mb.user, self.account) for al in Alias.objects.filter(domain=domain): diff --git a/modoboa/admin/tests.py b/modoboa/admin/tests.py index 08c1518bd..a1d04f8e1 100644 --- a/modoboa/admin/tests.py +++ b/modoboa/admin/tests.py @@ -89,7 +89,7 @@ class AccountTestCase(ModoTestCase): self.assertTrue(account.check_password("toto")) self.assertEqual(account.first_name, "Tester") self.assertEqual(account.last_name, "Toto") - self.assertEqual(mb.domain.mailbox_count, 3) + self.assertEqual(mb.domain.mailbox_count, 4) values["email"] = "pouet@test.com" self.check_ajax_post(reverse("modoboa.admin.views.editaccount", args=[account.id]), values) @@ -258,6 +258,25 @@ class PermissionsTestCase(ModoTestCase): HTTP_X_REQUESTED_WITH='XMLHttpRequest') self.assertNotEqual(response["Content-Type"], "application/json") + def test_domainadmin_deletes_superadmin(self): + """Check domain admins restrictions about super admins - + When a super admin owns a mailbox and a domain admin exists + for the associated domain, this domain admin must not be able + to access the super admin. + """ + values = dict(username="superadmin2@test.com", first_name="Super", last_name="Admin", + password1="toto", password2="toto", role="SuperAdmins", + is_active=True, email="superadmin@test.com", stepid=2) + self.check_ajax_post(reverse("modoboa.admin.views.newaccount"), values) + + account = User.objects.get(username="superadmin2@test.com") + self.clt.logout() + self.clt.login(username="admin@test.com", password="toto") + self.check_ajax_get(reverse("modoboa.admin.views.delaccount") + "?selection=%d" \ + % account.id, {}, + status="ko", respmsg="Permission denied") + self.check_ajax_get(reverse("modoboa.admin.views.delaccount") + "?selection=%d" \ + % 4, {}, + status="ko", respmsg="Permission denied")