Starts fixing superuser permissions

mailadmin/permissions.py

@@ -22,16 +22,30 @@ class IsOwnerOrReadOnly(permissions.BasePermission):
 
 class DestinationPrefixOwner(permissions.BasePermission):
     def has_permission(self, request, view):
-        fw = ForwardSerializer(data=request.DATA)
+        # TODO test handling the DELETE requests
+        if request.user.is_superuser:
+            return True
+
+        if request.method == 'DELETE':
+            forwarder = view.kwargs['forwarder']  # TODO you are here
+            invalid_forwarder = {'error': 'Invalid forwarder: {0}'.format(forwarder)}
+            if '=' not in forwarder:
+                return True
+
+            fwd_data = forwarder.split("=")
+            fw = ForwardSerializer(data={'dest': fwd_data[0], 'forward': fwd_data[1]})
+        else:
+            fw = ForwardSerializer(data=request.DATA)
+
         if not fw.is_valid():
             return True  # Skip auth if not valid data
 
         my_groups = request.user.groups.all()
         # Look for mailinglist prefixes
         my_prefixes = OrgUnit.objects.filter(admin_groups__in=my_groups).distinct().values_list('prefix', flat=True)
-        # Prepare regular expression
-        regexp = '|'.join(['{0}-'.format(p) for p in my_prefixes])
         if len(my_prefixes) == 0:
             return False
+        # Prepare regular expression
+        regexp = '|'.join(['{0}-'.format(p) for p in my_prefixes])
         # The destination should have at least one match with the prefix regexp
         return re.search(regexp, fw.data['dest']) is not None

mailadmin/views.py

@@ -60,7 +60,10 @@ class ForwardsViewSet(viewsets.ViewSet):
             my_groups = request.user.groups.filter(pk__in=group_filter)
 
         # Look for mailinglist prefixes
-        my_prefixes = OrgUnit.objects.filter(admin_groups__in=my_groups).distinct().values_list('prefix', flat=True)
+        if request.user.is_superuser:
+            my_prefixes = OrgUnit.objects.all().distinct().values_list('prefix', flat=True)
+        else:
+            my_prefixes = OrgUnit.objects.filter(admin_groups__in=my_groups).distinct().values_list('prefix', flat=True)
         # Prepare regular expression
         regexp = '|'.join(['{0}-'.format(p) for p in my_prefixes])
 
@@ -99,6 +102,7 @@ class ForwardCreateView(views.APIView):
 
 class ForwardDeleteView(views.APIView):
     _cp = CPanel()
+    permission_classes = (DestinationPrefixOwner,)
 
     def delete(self, request, forwarder=None):
         invalid_forwarder = {'error': 'Invalid forwarder: {0}'.format(forwarder)}