From 8c0d9516c3fc84dc1968b0eaa01b43afa5784066 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Tue, 14 Jan 2020 12:22:18 +0100 Subject: [PATCH 1/2] Remove domain permissions when role is SimpleUsers. see #1815 --- modoboa/admin/forms/account.py | 2 ++ modoboa/admin/tests/test_account.py | 3 +++ modoboa/admin/views/identity.py | 4 ++-- modoboa/core/models.py | 2 +- 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/modoboa/admin/forms/account.py b/modoboa/admin/forms/account.py index 66935db14..a336a0e47 100644 --- a/modoboa/admin/forms/account.py +++ b/modoboa/admin/forms/account.py @@ -476,6 +476,8 @@ class AccountPermissionsForm(forms.Form, DynamicForm): args[0], "domains", lib_fields.DomainNameField) def save(self): + if self.account.role == "SimpleUsers": + return current_domains = [ dom.name for dom in models.Domain.objects.get_for_admin(self.account) diff --git a/modoboa/admin/tests/test_account.py b/modoboa/admin/tests/test_account.py index 86775f6f1..b5010e9a3 100644 --- a/modoboa/admin/tests/test_account.py +++ b/modoboa/admin/tests/test_account.py @@ -544,6 +544,9 @@ class PermissionsTestCase(ModoTestCase): self.assertFalse( self.user.groups.filter(name="DomainAdmins").exists() ) + self.assertNotIn( + self.user, models.Domain.objects.get(name="test.com").admins.all() + ) def test_superusers(self): self.values["role"] = "SuperAdmins" diff --git a/modoboa/admin/views/identity.py b/modoboa/admin/views/identity.py index 1b8b3cf0d..b274a02c4 100644 --- a/modoboa/admin/views/identity.py +++ b/modoboa/admin/views/identity.py @@ -123,7 +123,7 @@ def list_quotas(request): @login_required @user_passes_test( - lambda u: u.has_perm("admin.add_user") or + lambda u: u.has_perm("core.add_user") or u.has_perm("admin.add_alias") or u.has_perm("admin.add_mailbox") ) @@ -136,7 +136,7 @@ def get_next_page(request): @login_required @user_passes_test( - lambda u: u.has_perm("admin.add_user") or + lambda u: u.has_perm("core.add_user") or u.has_perm("admin.add_alias") ) @ensure_csrf_cookie diff --git a/modoboa/core/models.py b/modoboa/core/models.py index e7d2743f2..12ab6b3c9 100644 --- a/modoboa/core/models.py +++ b/modoboa/core/models.py @@ -259,7 +259,7 @@ class User(AbstractUser): if role == "SuperAdmins": self.is_superuser = True else: - if self.is_superuser: + if self.is_superuser or self.has_perm("core.add_user"): ObjectAccess.objects.filter(user=self).delete() self.is_superuser = False try: From fe1845cd626791779027d2571f41aced9f652586 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Tue, 14 Jan 2020 14:14:15 +0100 Subject: [PATCH 2/2] Better fix. --- modoboa/core/models.py | 2 +- modoboa/limits/tests/test_user_limits.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modoboa/core/models.py b/modoboa/core/models.py index 12ab6b3c9..89046f3c7 100644 --- a/modoboa/core/models.py +++ b/modoboa/core/models.py @@ -259,7 +259,7 @@ class User(AbstractUser): if role == "SuperAdmins": self.is_superuser = True else: - if self.is_superuser or self.has_perm("core.add_user"): + if self.is_superuser or role == "SimpleUsers": ObjectAccess.objects.filter(user=self).delete() self.is_superuser = False try: diff --git a/modoboa/limits/tests/test_user_limits.py b/modoboa/limits/tests/test_user_limits.py index 4e514ffc7..8151cae23 100644 --- a/modoboa/limits/tests/test_user_limits.py +++ b/modoboa/limits/tests/test_user_limits.py @@ -31,8 +31,8 @@ class PermissionsTestCase(lib_tests.ModoTestCase): } self.ajax_post(reverse("admin:account_add"), values) account = User.objects.get(username="reseller@test.com") - self.client.logout() - self.client.login(username="admin@test.com", password="toto") + admin = User.objects.get(username="admin@test.com") + self.client.force_login(admin) resp = self.ajax_post( reverse("admin:account_delete", args=[account.id]), {}, status=403