Restore proper permissions.

see #317

modoboa/admin/models.py

@@ -231,34 +231,54 @@ class User(DUser):
             return False
         return True
 
-    def get_identities(self, squery=None):
+    def get_identities(self, querydict):
         """Return all identities owned by this user
 
-        :param squery: an optional filter
+        :param querydict: a querydict object
         :return: a queryset
         """
         from modoboa.lib.permissions import get_content_type
         from itertools import chain
 
-        userct = get_content_type(self)
-        ids = self.objectaccess_set.filter(content_type=userct) \
-            .values_list('object_id', flat=True)
-        q = Q(pk__in=ids)
-        if squery:
-            q &= Q(username__contains=squery)
-        result = User.objects.select_related().filter(q)
+        squery = querydict.get("searchquery", None)
+        idtfilter = querydict.getlist("idtfilter", None)
+        grpfilter = querydict.getlist("grpfilter", None)
+
+        accounts = []
+        if not idtfilter or "account" in idtfilter:
+            userct = get_content_type(self)
+            ids = self.objectaccess_set.filter(content_type=userct) \
+                .values_list('object_id', flat=True)
+            q = Q(pk__in=ids)
+            if squery:
+                q &= Q(username__contains=squery)
+            if grpfilter and len(grpfilter):
+                if "SuperAdmins" in grpfilter:
+                    q &= Q(is_superuser=True)
+                    grpfilter.remove("SuperAdmins")
+                    if len(grpfilter):
+                        q |= Q(groups__name__in=grpfilter)
+                else:
+                    q &= Q(groups__name__in=grpfilter)
+            accounts = User.objects.select_related().filter(q)
         
-        alct = get_content_type(Alias)
-        ids = self.objectaccess_set.filter(content_type=alct) \
-            .values_list('object_id', flat=True)
-        q = Q(pk__in=ids)
-        if squery:
-            if squery.find('@') != -1:
-                local_part, domname = split_mailbox(squery)
-                q &= Q(address__contains=local_part, domain__name__contains=domname)
-            else:
-                q &= Q(address__contains=squery)
-        return chain(result, Alias.objects.select_related().filter(q))
+        aliases = []
+        if not idtfilter or ("alias" in idtfilter 
+                             or "forward" in idtfilter 
+                             or "distribution list" in idtfilter):
+            alct = get_content_type(Alias)
+            ids = self.objectaccess_set.filter(content_type=alct) \
+                .values_list('object_id', flat=True)
+            q = Q(pk__in=ids)
+            if squery:
+                if squery.find('@') != -1:
+                    local_part, domname = split_mailbox(squery)
+                    q &= Q(address__contains=local_part, domain__name__contains=domname)
+                else:
+                    q &= Q(address__contains=squery)
+            aliases = Alias.objects.select_related().filter(q)
+
+        return chain(accounts, aliases)
 
 
     def get_domains(self):

modoboa/admin/static/admin/css/admin.css

@@ -1,5 +1,4 @@
 #searchform { 
-    text-align: center;
     margin-bottom: 10px;
 }
 

modoboa/admin/views.py

@@ -299,7 +299,7 @@ def delforward(request):
 @login_required
 @user_passes_test(lambda u: u.has_perm("auth.add_user") or u.has_perm("admin.add_alias"))
 def _identities(request):
-    idents_list = request.user.get_identities(request.GET.get("searchquery", None))
+    idents_list = request.user.get_identities(request.GET)
     objects = sorted(idents_list, key=lambda o: o.identity)
     
     paginator = Paginator(objects, int(parameters.get_admin("ITEMS_PER_PAGE")))
@@ -567,8 +567,11 @@ def import_account(user, row, formopts):
     account = User()
     account.from_csv(user, row, formopts["crypt_password"])
     grant_access_to_object(user, account, is_owner=True)
+    if account.is_superuser:
+        # Give access to the existing user
+        grant_access_to_object(account, user)
     events.raiseEvent("AccountCreated", account)
-    if len(account.mailbox_set.all()):
+    if account.mailbox_set.count():
         mb = account.mailbox_set.all()[0]
         grant_access_to_object(user, mb, is_owner=True)
         events.raiseEvent("CreateMailbox", user, mb)

modoboa/lib/permissions.py

@@ -2,6 +2,7 @@
 from functools import wraps
 from django.contrib.contenttypes.models import ContentType
 from django.utils.translation import ugettext as _
+from django.db import IntegrityError
 from modoboa.admin.models import ObjectAccess, IntegrityError
 import events
 from exceptions import ModoboaException
@@ -40,8 +41,8 @@ def grant_access_to_object(user, obj, is_owner=False):
     * He is the owner (he's just created the object)
     * He is going to administrate the object (but he is not the owner)
 
-    If the user is is the owner, we also grant access to this object
-    to all super users.
+    If the user is the owner, we also grant access to this object to
+    all super users.
 
     :param user: a ``User`` object
     :param obj: an admin. object (Domain, Mailbox, ...)
@@ -63,8 +64,12 @@ def grant_access_to_object(user, obj, is_owner=False):
         if is_owner:
             from modoboa.admin.models import User
             for su in User.objects.filter(is_superuser=True):
-                if su != user and su != obj:
+                if su == user:
+                    continue
+                try:
                     ObjectAccess.objects.create(user=su, content_type=ct, object_id=obj.id)
+                except IntegrityError:
+                    pass
 
     except IntegrityError, e:
         raise ModoboaException(_("Failed to grant access (%s)" % str(e)))