Merge pull request #1105 from modoboa/fix/domain_admin_restrictions

Security fixes.

modoboa/admin/forms/account.py

@@ -221,8 +221,9 @@ class AccountFormMail(forms.Form, DynamicForm):
         )
     )
 
-    def __init__(self, *args, **kwargs):
+    def __init__(self, user, *args, **kwargs):
         self.mb = kwargs.pop("instance", None)
+        self.user = user
         super(AccountFormMail, self).__init__(*args, **kwargs)
         self.field_widths = {
             "quota": 3
@@ -293,11 +294,22 @@ class AccountFormMail(forms.Form, DynamicForm):
                 continue
             if name.startswith("aliases"):
                 local_part, domname = split_mailbox(value)
-                if not models.Domain.objects.filter(name=domname).exists():
+                domain = models.Domain.objects.filter(name=domname).first()
+                if not domain:
                     self.add_error(name, _("Local domain does not exist"))
                     continue
+                if not self.user.can_access(domain):
+                    self.add_error(
+                        name, _("You don't have access to this domain"))
+                    continue
                 self.aliases.append(value.lower())
             elif name.startswith("senderaddress"):
+                local_part, domname = split_mailbox(value)
+                domain = models.Domain.objects.filter(name=domname).first()
+                if domain and not self.user.can_access(domain):
+                    self.add_error(
+                        name, _("You don't have access to this domain"))
+                    continue
                 self.sender_addresses.append(value.lower())
         return cleaned_data
 
@@ -443,7 +455,8 @@ class AccountForm(TabForms):
              "new_args": [self.user], "mandatory": True},
             {"id": "mail",
              "title": _("Mail"), "formtpl": "admin/mailform.html",
-             "cls": AccountFormMail},
+             "cls": AccountFormMail,
+             "new_args": [self.user]},
             {"id": "perms", "title": _("Permissions"),
              "formtpl": "admin/permsform.html",
              "cls": AccountPermissionsForm}
@@ -529,7 +542,8 @@ class AccountWizard(WizardForm):
         self.add_step(
             WizardStep(
                 "mail", AccountFormMail, _("Mail"),
-                "admin/mailform.html"
+                "admin/mailform.html",
+                new_args=[request.user]
             )
         )
 

modoboa/admin/tests/test_account.py

@@ -115,6 +115,24 @@ class AccountTestCase(ModoTestCase):
                 mailbox__address="user").count(),
             1)
 
+    def test_sender_address_as_domainadmin(self):
+        """Check that restrictions are applied."""
+        admin = User.objects.get(username="admin@test.com")
+        self.client.force_login(admin)
+        account = User.objects.get(username="user@test.com")
+        values = {
+            "username": "user@test.com", "first_name": "Tester",
+            "last_name": "Toto", "role": "SimpleUsers",
+            "quota_act": True, "is_active": True, "email": "user@test.com",
+            "senderaddress": "test@titi.com",
+            "senderaddress_1": "toto@test2.com"
+        }
+        response = self.ajax_post(
+            reverse("admin:account_change", args=[account.pk]), values, 400)
+        self.assertEqual(
+            response["form_errors"]["senderaddress_1"][0],
+            "You don't have access to this domain")
+
     def test_conflicts(self):
         """Check if unicity constraints are respected."""
         values = {

modoboa/admin/tests/test_alias.py

@@ -265,3 +265,22 @@ class AliasTestCase(ModoTestCase):
         self.assertEqual(response.status_code, 200)
         self.assertIn("Summary", response.content)
         self.assertIn("Recipients", response.content)
+
+    def test_domainadmin_restrictions(self):
+        """Check that restrictions are applied."""
+        admin = User.objects.get(username="admin@test.com")
+        self.client.force_login(admin)
+
+        user = User.objects.get(username="user@test.com")
+        values = dict(
+            username="user@test.com", role=user.role,
+            is_active=user.is_active, email="user@test.com",
+            aliases="toto@test.com", aliases_1="titi@test2.com"
+        )
+        response = self.ajax_post(
+            reverse("admin:account_change", args=[user.id]),
+            values, 400
+        )
+        self.assertEqual(
+            response["form_errors"]["aliases_1"][0],
+            "You don't have access to this domain")