Merge pull request #1824 from modoboa/fix/remove_permissions

Remove domain permissions when role is SimpleUsers.

modoboa/admin/forms/account.py

@@ -476,6 +476,8 @@ class AccountPermissionsForm(forms.Form, DynamicForm):
                 args[0], "domains", lib_fields.DomainNameField)
 
     def save(self):
+        if self.account.role == "SimpleUsers":
+            return
         current_domains = [
             dom.name for dom in
             models.Domain.objects.get_for_admin(self.account)

modoboa/admin/tests/test_account.py

@@ -544,6 +544,9 @@ class PermissionsTestCase(ModoTestCase):
         self.assertFalse(
             self.user.groups.filter(name="DomainAdmins").exists()
         )
+        self.assertNotIn(
+            self.user, models.Domain.objects.get(name="test.com").admins.all()
+        )
 
     def test_superusers(self):
         self.values["role"] = "SuperAdmins"

modoboa/admin/views/identity.py

@@ -123,7 +123,7 @@ def list_quotas(request):
 
 @login_required
 @user_passes_test(
-    lambda u: u.has_perm("admin.add_user") or
+    lambda u: u.has_perm("core.add_user") or
     u.has_perm("admin.add_alias") or
     u.has_perm("admin.add_mailbox")
 )
@@ -136,7 +136,7 @@ def get_next_page(request):
 
 @login_required
 @user_passes_test(
-    lambda u: u.has_perm("admin.add_user") or
+    lambda u: u.has_perm("core.add_user") or
     u.has_perm("admin.add_alias")
 )
 @ensure_csrf_cookie

modoboa/core/models.py

@@ -259,7 +259,7 @@ class User(AbstractUser):
         if role == "SuperAdmins":
             self.is_superuser = True
         else:
-            if self.is_superuser:
+            if self.is_superuser or role == "SimpleUsers":
                 ObjectAccess.objects.filter(user=self).delete()
             self.is_superuser = False
             try:

modoboa/limits/tests/test_user_limits.py

@@ -31,8 +31,8 @@ class PermissionsTestCase(lib_tests.ModoTestCase):
         }
         self.ajax_post(reverse("admin:account_add"), values)
         account = User.objects.get(username="reseller@test.com")
-        self.client.logout()
-        self.client.login(username="admin@test.com", password="toto")
+        admin = User.objects.get(username="admin@test.com")
+        self.client.force_login(admin)
         resp = self.ajax_post(
             reverse("admin:account_delete", args=[account.id]),
             {}, status=403