From cc4d60e4798e89cc1eaa847823aa3e54464c41a1 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Fri, 10 Apr 2015 15:13:47 +0200 Subject: [PATCH] Move DomainAdmins references (almost all) inside modoboa_admin. --- doc/extending/events.rst | 9 ++-- modoboa/core/__init__.py | 5 --- modoboa/core/extensions.py | 41 +++++++++++-------- .../management/commands/load_initial_data.py | 2 +- modoboa/core/models.py | 7 +++- modoboa/lib/permissions.py | 9 +--- 6 files changed, 38 insertions(+), 35 deletions(-) diff --git a/doc/extending/events.rst b/doc/extending/events.rst index 8b780d4a6..5d4964a2a 100644 --- a/doc/extending/events.rst +++ b/doc/extending/events.rst @@ -619,14 +619,16 @@ name, the model name and the permission name. Example:: GetExtraRoles ============= -Let extensions define new administrative roles. +Let extensions define new administrative roles (will be used to create +or modify an account). *Callback prototype*:: - def callback(user): pass + def callback(user, account): pass * ``user`` is a ``User`` instance corresponding to the currently logged in user +* ``account`` is the account being modified (None on creation) Callbacks listening to this event must return a list of 2uple (two strings) which respect the following format: ``(value, label)``. @@ -922,11 +924,12 @@ account. *Callback prototype*:: - def callback(account, role): pass + def callback(user, role, account): pass * ``user`` is the ``User`` instance corresponding to the currently logged in user * ``role`` is the role ``user`` tries to set +* ``account`` is the account being modified (None on creation) Must return a list containing ``True`` or ``False`` to indicate if this user can is allowed to set ``role``. diff --git a/modoboa/core/__init__.py b/modoboa/core/__init__.py index 210c9f167..9da184959 100644 --- a/modoboa/core/__init__.py +++ b/modoboa/core/__init__.py @@ -45,11 +45,6 @@ BASE_EVENTS = [ ] PERMISSIONS = { - "DomainAdmins": [ - ["core", "user", "add_user"], - ["core", "user", "change_user"], - ["core", "user", "delete_user"], - ], "SimpleUsers": [] } diff --git a/modoboa/core/extensions.py b/modoboa/core/extensions.py index 6037c1cd8..6b84ce3dc 100644 --- a/modoboa/core/extensions.py +++ b/modoboa/core/extensions.py @@ -75,6 +75,28 @@ class ExtensionsPool(object): return None return instance.infos() + def load_extension(self, name): + """Load a registered extension.""" + __import__(name, locals(), globals(), ["modo_extension"]) + extinstance = self.get_extension(name) + if extinstance is None: + return None + result = None + try: + baseurl = ( + extinstance.url if extinstance.url is not None + else name + ) + result = ( + r'^%s/' % (baseurl), + include("{0}.urls".format(name), namespace=name) + ) + except ImportError: + # No urls for this extension + pass + extinstance.load() + return result + def load_all(self): """Load all defined extensions. @@ -88,22 +110,9 @@ class ExtensionsPool(object): """ result = [] for ext in settings.MODOBOA_APPS: - __import__(ext, locals(), globals(), ["modo_extension"]) - extname = ext.split('.')[-1] - extinstance = self.get_extension(extname) - if extinstance is None: - continue - try: - baseurl = extinstance.url \ - if extinstance.url is not None else extname - result += [ - (r'^%s/' % (baseurl), - include("{0}.urls".format(ext), namespace=extname)) - ] - except ImportError: - # No urls for this extension - pass - extinstance.load() + ext_urls = self.load_extension(ext) + if ext_urls is not None: + result += [ext_urls] return result def list_all(self, check_new_versions=False): diff --git a/modoboa/core/management/commands/load_initial_data.py b/modoboa/core/management/commands/load_initial_data.py index 341d3f376..e8cdd8229 100644 --- a/modoboa/core/management/commands/load_initial_data.py +++ b/modoboa/core/management/commands/load_initial_data.py @@ -38,7 +38,7 @@ class Command(BaseCommand, CloseConnectionMixin): superadmin = User.objects.filter(is_superuser=True).first() groups = PERMISSIONS.keys() + [ role[0] for role - in events.raiseQueryEvent("GetExtraRoles", superadmin) + in events.raiseQueryEvent("GetExtraRoles", superadmin, None) ] for groupname in groups: group, created = Group.objects.get_or_create(name=groupname) diff --git a/modoboa/core/models.py b/modoboa/core/models.py index 80b77bb15..811d2246e 100644 --- a/modoboa/core/models.py +++ b/modoboa/core/models.py @@ -335,11 +335,14 @@ class User(PermissionsMixin): :param row: a list containing the expected information :param crypt_password: """ + from modoboa.lib.permissions import get_account_roles + if len(row) < 7: raise BadRequest(_("Invalid line")) + allowed_roles = get_account_roles(user) + allowed_roles = [role[0] for role in allowed_roles] role = row[6].strip() - allowed_roles = ["SimpleUsers", "DomainAdmins"] - if not user.is_superuser and role not in allowed_roles: + if role not in allowed_roles: raise PermDeniedException( _("You can't import an account with a role greater than yours") ) diff --git a/modoboa/lib/permissions.py b/modoboa/lib/permissions.py index c993c2b04..fe5fd62e1 100644 --- a/modoboa/lib/permissions.py +++ b/modoboa/lib/permissions.py @@ -2,7 +2,6 @@ from django.contrib.auth.models import Group, Permission from django.contrib.contenttypes.models import ContentType -from django.db import IntegrityError from django.utils.translation import ugettext as _ from modoboa.core.models import ObjectAccess, User @@ -22,13 +21,7 @@ def get_account_roles(user, account=None): std_roles = [("SimpleUsers", _("Simple user"))] if user.is_superuser: std_roles += [("SuperAdmins", _("Super administrator"))] - filters = events.raiseQueryEvent( - 'UserCanSetRole', user, 'DomainAdmins', account - ) - if user.has_perm("admin.add_domain") and \ - (not filters or True in filters): - std_roles += [("DomainAdmins", _("Domain administrator"))] - std_roles += events.raiseQueryEvent("GetExtraRoles", user) + std_roles += events.raiseQueryEvent("GetExtraRoles", user, account) return sorted(std_roles, key=lambda role: role[1])