Prevent accounts with restricted permissions to create greater roles.

fixes #412

modoboa/admin/forms.py

@@ -502,7 +502,7 @@ class AccountFormGeneral(forms.ModelForm):
                     try:
                         role = u.groups.all()[0].name
                     except IndexError:
-                        pass
+                        role = "SimpleUsers"
                 self.fields["role"].initial = role
 
     def clean_username(self):

modoboa/admin/models.py

@@ -470,6 +470,11 @@ class User(DUser):
         """
         if len(row) < 6:
             raise AdminError(_("Invalid line"))
+        role = row[6].strip()
+        if not user.is_superuser and not role in ["SimpleUsers", "DomainAdmins"]:
+            raise PermDeniedException(
+                _("You can't import an account with a role greater than yours")
+            )
         self.username = row[1].strip()
         if crypt_password:
             self.set_password(row[2].strip())
@@ -479,7 +484,7 @@ class User(DUser):
         self.last_name = row[4].strip()
         self.is_active = (row[5].strip() == 'True')
         self.save(creator=user)
-        self.set_role(row[6].strip())
+        self.set_role(role)
 
         self.email = row[7].strip()
         if self.email != "":
@@ -487,7 +492,9 @@ class User(DUser):
             try:
                 domain = Domain.objects.get(name=domname)
             except Domain.DoesNotExist:
-                raise AdminError(_("Account import failed (%s): domain does not exist" % self.username))
+                raise AdminError(
+                    _("Account import failed (%s): domain does not exist" % self.username)
+                )
             if not user.can_access(domain):
                 raise PermDeniedException
             mb = Mailbox(address=mailbox, domain=domain, user=self, use_domain_quota=True)

modoboa/admin/tests.py

@@ -316,6 +316,12 @@ class PermissionsTestCase(ModoTestCase):
 class ImportTestCase(ModoTestCase):
     fixtures = ["initial_users.json", "test_content.json"]
 
+    def setUp(self):
+        super(ImportTestCase, self).setUp()
+        self.admin = User.objects.get(username="admin@test.com")
+        dom = Domain.objects.get(name="test.com")
+        dom.add_admin(self.admin)
+
     def test_domains_import(self):
         f = ContentFile(b"""domain; domain1.com; 100; True
 domain; domain2.com; 200; False
@@ -393,3 +399,19 @@ account; truc@test.com; toto; René; Truc; True; DomainAdmins; truc@test.com; te
         admin = User.objects.get(username="admin")
         u1 = User.objects.get(username="truc@test.com")
         self.assertTrue(admin.is_owner(u1))
+
+    def test_import_superadmin(self):
+        """Check if a domain admin can import a superadmin
+
+        Expected result: no
+        """
+        self.clt.logout()
+        self.assertTrue(self.clt.login(username="admin@test.com", password="toto"))
+        f = ContentFile(b"""
+account; sa@test.com; toto; Super; Admin; True; SuperAdmins; superadmin@test.com
+""", name="identities.csv")
+        self.clt.post(reverse("modoboa.admin.views.import_identities"), {
+            "sourcefile": f, "crypt_password": True, "continue_if_exists": True
+        })
+        with self.assertRaises(User.DoesNotExist):
+            User.objects.get(username="sa@test.com")