Every user with a role greater than domain admin should not be accessible to a domain admin.

see #394

modoboa/admin/forms.py

@@ -563,11 +563,12 @@ class AccountFormMail(forms.Form, DynamicForm):
                                        owner=user)
                 grant_access_to_object(user, self.mb, is_owner=True)
                 events.raiseEvent("CreateMailbox", user, self.mb)
-                if user.is_superuser and not self.mb.user.is_superuser:
+                if user.is_superuser and not self.mb.user.has_perm("admin.add_domain"):
                     # A super user is creating a new mailbox. Give
                     # access to that mailbox (and the associated
                     # account) to the appropriate domain admins,
-                    # except if the new account is super user.
+                    # except if the new account has a more important
+                    # role (SuperAdmin, Reseller)
                     for admin in self.mb.domain.admins:
                         grant_access_to_object(admin, self.mb)
                         grant_access_to_object(admin, self.mb.user)
@@ -662,7 +663,9 @@ class AccountPermissionsForm(forms.Form, DynamicForm):
             if not value in current_domains:
                 domain = Domain.objects.get(name=value)
                 grant_access_to_object(self.account, domain)
-                for mb in domain.mailbox_set.filter(user__is_superuser=False).all():
+                for mb in domain.mailbox_set.all():
+                    if mb.user.has_perm("admin.add_domain"):
+                        continue
                     grant_access_to_object(self.account, mb)
                     grant_access_to_object(self.account, mb.user)
                 for al in Alias.objects.filter(domain=domain):
@@ -672,7 +675,9 @@ class AccountPermissionsForm(forms.Form, DynamicForm):
             if not len(filter(lambda name: self.cleaned_data[name] == domain.name,
                               self.cleaned_data.keys())):
                 ungrant_access_to_object(domain, self.account)
-                for mb in domain.mailbox_set.filter(user__is_superuser=False).all():
+                for mb in domain.mailbox_set.all():
+                    if mb.user.has_perm("admin.add_domain"):
+                        continue
                     ungrant_access_to_object(mb, self.account)
                     ungrant_access_to_object(mb.user, self.account)
                 for al in Alias.objects.filter(domain=domain):

modoboa/admin/models.py

@@ -325,9 +325,13 @@ class User(DUser):
         
         :return: a list of ``Mailbox`` objects
         """
+        from modoboa.lib.permissions import get_content_type
+
         if self.is_superuser:
             return Mailbox.objects.all()
-        return Mailbox.objects.filter(domain__in=self.get_domains())
+        ids = self.objectaccess_set.filter(content_type=get_content_type(Mailbox)) \
+            .values_list('object_id', flat=True)
+        return Mailbox.objects.filter(pk__in=ids)
         
     def get_mbaliases(self):
         """Return the mailbox aliases that belong to this user

modoboa/admin/templates/admin/listing.html

@@ -7,15 +7,15 @@ var admin;
 </script>
 {% endblock %}
 {% block leftcol %}<div class="well sidebar-nav">
-<ul class="nav nav-list">
-  <li class="nav-header">{% trans "Filter" %}</li>
-  <li>{% include "admin/searchform.html" %}</li>
-  <li id="taglist"></li>
-  <li class="nav-header">{% trans "Actions" %}</li>
-  {% block actions %}{% endblock %}
-  {% get_extra_admin_content user "leftcol" selection %}
-</ul>
+  <ul class="nav nav-list">
+    <li class="nav-header">{% trans "Filter" %}</li>
+    <li>{% include "admin/searchform.html" %}</li>
+    <li id="taglist"></li>
+    <li class="nav-header">{% trans "Actions" %}</li>
+    {% block actions %}{% endblock %}
+  </ul>
 </div>
+{% get_extra_admin_content user "leftcol" selection %}
 {% endblock %}
 {% block apparea %}<div id="listing"></div>{% endblock %}
 {% block footerright %}{% endblock %}

modoboa/extensions/limits/templates/limits/poolusage.html

@@ -1,8 +1,10 @@
 {% load i18n libextras %}
-<div class="well">
-  <h6>{% trans "Resources usage" %}</h6>{% for l in limits %}
-  <div class="resource">
-    {{ l.label }} ({{ l }})
-    <div rel="tooltip" title="{{ l.curvalue }}/{{ l.maxvalue }}" class="progress {% progress_color l.usage %}"><div class="bar" style="width: {{ l }}"></div></div>
-  </div>
-{% endfor %}</div>
+<div class="well sidebar-nav">
+  <ul class="nav nav-list">
+    <li class="nav-header">{% trans "Resources usage" %}</li>{% for l in limits %}
+    <li class="resource">
+      {{ l.label }} ({{ l }})
+      <div rel="tooltip" title="{{ l.curvalue }}/{{ l.maxvalue }}" class="progress {% progress_color l.usage %}"><div class="bar" style="width: {{ l }}"></div></div>
+    </li>{% endfor %}
+  </ul>
+</div>

modoboa/lib/tests.py

@@ -19,7 +19,7 @@ class ModoTestCase(TestCase):
         self.assertEqual(response.status_code, 200)
         obj = simplejson.loads(response.content)
         self.assertEqual(obj["status"], status)
-        for kw, v in kwargs.iteritems():
+        for kw, v in kwargs.items():
             self.assertEqual(obj[kw], v)
 
     def check_ajax_post(self, *args, **kwargs):