From 8c0d9516c3fc84dc1968b0eaa01b43afa5784066 Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Tue, 14 Jan 2020 12:22:18 +0100
Subject: [PATCH] Remove domain permissions when role is SimpleUsers.

see #1815
---
 modoboa/admin/forms/account.py      | 2 ++
 modoboa/admin/tests/test_account.py | 3 +++
 modoboa/admin/views/identity.py     | 4 ++--
 modoboa/core/models.py              | 2 +-
 4 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/modoboa/admin/forms/account.py b/modoboa/admin/forms/account.py
index 66935db14..a336a0e47 100644
--- a/modoboa/admin/forms/account.py
+++ b/modoboa/admin/forms/account.py
@@ -476,6 +476,8 @@ class AccountPermissionsForm(forms.Form, DynamicForm):
                 args[0], "domains", lib_fields.DomainNameField)
 
     def save(self):
+        if self.account.role == "SimpleUsers":
+            return
         current_domains = [
             dom.name for dom in
             models.Domain.objects.get_for_admin(self.account)
diff --git a/modoboa/admin/tests/test_account.py b/modoboa/admin/tests/test_account.py
index 86775f6f1..b5010e9a3 100644
--- a/modoboa/admin/tests/test_account.py
+++ b/modoboa/admin/tests/test_account.py
@@ -544,6 +544,9 @@ class PermissionsTestCase(ModoTestCase):
         self.assertFalse(
             self.user.groups.filter(name="DomainAdmins").exists()
         )
+        self.assertNotIn(
+            self.user, models.Domain.objects.get(name="test.com").admins.all()
+        )
 
     def test_superusers(self):
         self.values["role"] = "SuperAdmins"
diff --git a/modoboa/admin/views/identity.py b/modoboa/admin/views/identity.py
index 1b8b3cf0d..b274a02c4 100644
--- a/modoboa/admin/views/identity.py
+++ b/modoboa/admin/views/identity.py
@@ -123,7 +123,7 @@ def list_quotas(request):
 
 @login_required
 @user_passes_test(
-    lambda u: u.has_perm("admin.add_user") or
+    lambda u: u.has_perm("core.add_user") or
     u.has_perm("admin.add_alias") or
     u.has_perm("admin.add_mailbox")
 )
@@ -136,7 +136,7 @@ def get_next_page(request):
 
 @login_required
 @user_passes_test(
-    lambda u: u.has_perm("admin.add_user") or
+    lambda u: u.has_perm("core.add_user") or
     u.has_perm("admin.add_alias")
 )
 @ensure_csrf_cookie
diff --git a/modoboa/core/models.py b/modoboa/core/models.py
index e7d2743f2..12ab6b3c9 100644
--- a/modoboa/core/models.py
+++ b/modoboa/core/models.py
@@ -259,7 +259,7 @@ class User(AbstractUser):
         if role == "SuperAdmins":
             self.is_superuser = True
         else:
-            if self.is_superuser:
+            if self.is_superuser or self.has_perm("core.add_user"):
                 ObjectAccess.objects.filter(user=self).delete()
             self.is_superuser = False
             try: