Restrict the access.

fixed #150

extensions/sievefilters/views.py

@@ -5,13 +5,14 @@ from django.contrib.auth.decorators import login_required
 from django.utils.translation import ugettext as _
 from django.core.urlresolvers import reverse
 from modoboa.lib import _render, _render_to_string, _render_error, \
-    ajax_response, ajax_simple_response, parameters
+    ajax_response, ajax_simple_response, is_not_localadmin, parameters
 from modoboa.lib.connections import ConnectionError
 from modoboa.auth.lib import get_password
 from lib import *
 from forms import *
 
 @login_required
+@is_not_localadmin()
 def index(request, tplname="sievefilters/index.html"):
     try:
         sc = SieveClient(user=request.user.username, 
@@ -35,12 +36,14 @@ def index(request, tplname="sievefilters/index.html"):
             })
 
 @login_required
+@is_not_localadmin()
 def get_templates(request, ftype):
     if ftype == "condition":
         return ajax_simple_response(FilterForm.cond_templates)
     return ajax_simple_response(FilterForm.action_templates)
 
 @login_required
+@is_not_localadmin()
 def get_user_folders(request):
     from modoboa.extensions.webmail.lib import IMAPconnector
 
@@ -50,6 +53,7 @@ def get_user_folders(request):
     return ajax_simple_response(ret)
 
 @login_required
+@is_not_localadmin()
 def getfs(request, name):
     sc = SieveClient(user=request.user.username, 
                      password=request.session["password"])
@@ -103,6 +107,7 @@ def submitfilter(request, setname, okmsg, tplname, tplctx, update=False, sc=None
     return ajax_response(request, status="ko", template=tplname, **tplctx)
 
 @login_required
+@is_not_localadmin()
 def newfilter(request, setname, tplname="sievefilters/filter.html"):
     ctx = {"title" : _("New filter"),
            "actionurl" : reverse(newfilter, args=[setname])}
@@ -116,6 +121,7 @@ def newfilter(request, setname, tplname="sievefilters/filter.html"):
     return _render(request, tplname, ctx)
 
 @login_required
+@is_not_localadmin()
 def editfilter(request, setname, fname, tplname="sievefilters/filter.html"):
     ctx = {"title" : _("Edit filter"),
            "actionurl" : reverse(editfilter, args=[setname, fname])}
@@ -135,6 +141,7 @@ def editfilter(request, setname, fname, tplname="sievefilters/filter.html"):
     return _render(request, tplname, ctx)
 
 @login_required
+@is_not_localadmin()
 def removefilter(request, setname, fname):
     sc = SieveClient(user=request.user.username, 
                      password=request.session["password"])
@@ -145,6 +152,7 @@ def removefilter(request, setname, fname):
     return ajax_response(request, "ko", respmsg=_("Failed to remove filter"))
 
 @login_required
+@is_not_localadmin()
 def savefs(request, name):
     if not request.POST.has_key("scriptcontent"):
         return
@@ -158,6 +166,7 @@ def savefs(request, name):
     return ajax_response(request, respmsg=_("Filters set saved"))
     
 @login_required
+@is_not_localadmin()
 def new_filters_set(request, tplname="sievefilters/newfiltersset.html"):
     ctx = {"title" : _("Create a new filters set"),
            "fname" : "newfiltersset",
@@ -188,6 +197,7 @@ def new_filters_set(request, tplname="sievefilters/newfiltersset.html"):
     return _render(request, tplname, ctx)
 
 @login_required
+@is_not_localadmin()
 def remove_filters_set(request, name):
     sc = SieveClient(user=request.user.username, 
                      password=request.session["password"])
@@ -198,6 +208,7 @@ def remove_filters_set(request, name):
     return ajax_response(request, respmsg=_("Filters set deleted"))
 
 @login_required
+@is_not_localadmin()
 def activate_filters_set(request, name):
     sc = SieveClient(user=request.user.username, 
                      password=request.session["password"])
@@ -208,6 +219,7 @@ def activate_filters_set(request, name):
     return ajax_response(request, respmsg=_("Filters set activated"))
 
 @login_required
+@is_not_localadmin()
 def download_filters_set(request, name):
     sc = SieveClient(user=request.user.username, 
                      password=request.session["password"])
@@ -223,6 +235,7 @@ def download_filters_set(request, name):
     return resp
 
 @login_required
+@is_not_localadmin()
 def toggle_filter_state(request, setname, fname):
     sc = SieveClient(user=request.user.username, 
                      password=request.session["password"])
@@ -260,9 +273,11 @@ def move_filter(request, setname, fname, direction):
     return ajax_response(request, template="sievefilters/filters.html", fs=fset)
 
 @login_required
+@is_not_localadmin()
 def move_filter_up(request, setname, fname):
     return move_filter(request, setname, fname, "up")
 
 @login_required
+@is_not_localadmin()
 def move_filter_down(request, setname, fname):
     return move_filter(request, setname, fname, "down")