Remove domain permissions when role is SimpleUsers.

see #1815

modoboa/admin/forms/account.py

@@ -476,6 +476,8 @@ class AccountPermissionsForm(forms.Form, DynamicForm):
                 args[0], "domains", lib_fields.DomainNameField)
 
     def save(self):
+        if self.account.role == "SimpleUsers":
+            return
         current_domains = [
             dom.name for dom in
             models.Domain.objects.get_for_admin(self.account)

modoboa/admin/tests/test_account.py

@@ -544,6 +544,9 @@ class PermissionsTestCase(ModoTestCase):
         self.assertFalse(
             self.user.groups.filter(name="DomainAdmins").exists()
         )
+        self.assertNotIn(
+            self.user, models.Domain.objects.get(name="test.com").admins.all()
+        )
 
     def test_superusers(self):
         self.values["role"] = "SuperAdmins"

modoboa/admin/views/identity.py

@@ -123,7 +123,7 @@ def list_quotas(request):
 
 @login_required
 @user_passes_test(
-    lambda u: u.has_perm("admin.add_user") or
+    lambda u: u.has_perm("core.add_user") or
     u.has_perm("admin.add_alias") or
     u.has_perm("admin.add_mailbox")
 )
@@ -136,7 +136,7 @@ def get_next_page(request):
 
 @login_required
 @user_passes_test(
-    lambda u: u.has_perm("admin.add_user") or
+    lambda u: u.has_perm("core.add_user") or
     u.has_perm("admin.add_alias")
 )
 @ensure_csrf_cookie

modoboa/core/models.py

@@ -259,7 +259,7 @@ class User(AbstractUser):
         if role == "SuperAdmins":
             self.is_superuser = True
         else:
-            if self.is_superuser:
+            if self.is_superuser or self.has_perm("core.add_user"):
                 ObjectAccess.objects.filter(user=self).delete()
             self.is_superuser = False
             try: