From c11d2c9f0db094e4b36ce061cca857104987d7ad Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Sat, 19 Jan 2013 19:02:31 +0100 Subject: [PATCH] Restore proper permissions. see #317 --- modoboa/admin/models.py | 60 ++++++++++++++++-------- modoboa/admin/static/admin/css/admin.css | 1 - modoboa/admin/views.py | 7 ++- modoboa/lib/permissions.py | 11 +++-- 4 files changed, 53 insertions(+), 26 deletions(-) diff --git a/modoboa/admin/models.py b/modoboa/admin/models.py index 24c8496e7..65c1961c6 100644 --- a/modoboa/admin/models.py +++ b/modoboa/admin/models.py @@ -231,34 +231,54 @@ class User(DUser): return False return True - def get_identities(self, squery=None): + def get_identities(self, querydict): """Return all identities owned by this user - :param squery: an optional filter + :param querydict: a querydict object :return: a queryset """ from modoboa.lib.permissions import get_content_type from itertools import chain - userct = get_content_type(self) - ids = self.objectaccess_set.filter(content_type=userct) \ - .values_list('object_id', flat=True) - q = Q(pk__in=ids) - if squery: - q &= Q(username__contains=squery) - result = User.objects.select_related().filter(q) + squery = querydict.get("searchquery", None) + idtfilter = querydict.getlist("idtfilter", None) + grpfilter = querydict.getlist("grpfilter", None) + + accounts = [] + if not idtfilter or "account" in idtfilter: + userct = get_content_type(self) + ids = self.objectaccess_set.filter(content_type=userct) \ + .values_list('object_id', flat=True) + q = Q(pk__in=ids) + if squery: + q &= Q(username__contains=squery) + if grpfilter and len(grpfilter): + if "SuperAdmins" in grpfilter: + q &= Q(is_superuser=True) + grpfilter.remove("SuperAdmins") + if len(grpfilter): + q |= Q(groups__name__in=grpfilter) + else: + q &= Q(groups__name__in=grpfilter) + accounts = User.objects.select_related().filter(q) - alct = get_content_type(Alias) - ids = self.objectaccess_set.filter(content_type=alct) \ - .values_list('object_id', flat=True) - q = Q(pk__in=ids) - if squery: - if squery.find('@') != -1: - local_part, domname = split_mailbox(squery) - q &= Q(address__contains=local_part, domain__name__contains=domname) - else: - q &= Q(address__contains=squery) - return chain(result, Alias.objects.select_related().filter(q)) + aliases = [] + if not idtfilter or ("alias" in idtfilter + or "forward" in idtfilter + or "distribution list" in idtfilter): + alct = get_content_type(Alias) + ids = self.objectaccess_set.filter(content_type=alct) \ + .values_list('object_id', flat=True) + q = Q(pk__in=ids) + if squery: + if squery.find('@') != -1: + local_part, domname = split_mailbox(squery) + q &= Q(address__contains=local_part, domain__name__contains=domname) + else: + q &= Q(address__contains=squery) + aliases = Alias.objects.select_related().filter(q) + + return chain(accounts, aliases) def get_domains(self): diff --git a/modoboa/admin/static/admin/css/admin.css b/modoboa/admin/static/admin/css/admin.css index 7f87f9f60..831e03a6b 100644 --- a/modoboa/admin/static/admin/css/admin.css +++ b/modoboa/admin/static/admin/css/admin.css @@ -1,5 +1,4 @@ #searchform { - text-align: center; margin-bottom: 10px; } diff --git a/modoboa/admin/views.py b/modoboa/admin/views.py index 7e325a8e3..9c69d238b 100644 --- a/modoboa/admin/views.py +++ b/modoboa/admin/views.py @@ -299,7 +299,7 @@ def delforward(request): @login_required @user_passes_test(lambda u: u.has_perm("auth.add_user") or u.has_perm("admin.add_alias")) def _identities(request): - idents_list = request.user.get_identities(request.GET.get("searchquery", None)) + idents_list = request.user.get_identities(request.GET) objects = sorted(idents_list, key=lambda o: o.identity) paginator = Paginator(objects, int(parameters.get_admin("ITEMS_PER_PAGE"))) @@ -567,8 +567,11 @@ def import_account(user, row, formopts): account = User() account.from_csv(user, row, formopts["crypt_password"]) grant_access_to_object(user, account, is_owner=True) + if account.is_superuser: + # Give access to the existing user + grant_access_to_object(account, user) events.raiseEvent("AccountCreated", account) - if len(account.mailbox_set.all()): + if account.mailbox_set.count(): mb = account.mailbox_set.all()[0] grant_access_to_object(user, mb, is_owner=True) events.raiseEvent("CreateMailbox", user, mb) diff --git a/modoboa/lib/permissions.py b/modoboa/lib/permissions.py index 1897e0b5f..5f19e4685 100644 --- a/modoboa/lib/permissions.py +++ b/modoboa/lib/permissions.py @@ -2,6 +2,7 @@ from functools import wraps from django.contrib.contenttypes.models import ContentType from django.utils.translation import ugettext as _ +from django.db import IntegrityError from modoboa.admin.models import ObjectAccess, IntegrityError import events from exceptions import ModoboaException @@ -40,8 +41,8 @@ def grant_access_to_object(user, obj, is_owner=False): * He is the owner (he's just created the object) * He is going to administrate the object (but he is not the owner) - If the user is is the owner, we also grant access to this object - to all super users. + If the user is the owner, we also grant access to this object to + all super users. :param user: a ``User`` object :param obj: an admin. object (Domain, Mailbox, ...) @@ -63,8 +64,12 @@ def grant_access_to_object(user, obj, is_owner=False): if is_owner: from modoboa.admin.models import User for su in User.objects.filter(is_superuser=True): - if su != user and su != obj: + if su == user: + continue + try: ObjectAccess.objects.create(user=su, content_type=ct, object_id=obj.id) + except IntegrityError: + pass except IntegrityError, e: raise ModoboaException(_("Failed to grant access (%s)" % str(e)))