[GH-ISSUE #181] Non Super-admin can change domain quota #142

New issue

Closed

opened 2026-02-26 09:36:16 +03:00 by kerem · 2 comments

kerem commented

2026-02-26 09:36:16 +03:00

Owner

Originally created by @fabiorauber on GitHub (Apr 14, 2016).
Original GitHub issue: https://github.com/opensolutions/ViMbAdmin/issues/181

A non super-admin user can change the max quota for the domain for which he is admin. I believe this is a bug, because the Wiki on Quotas describes max quota as:

NB: maxquota does not define a maximum allowed quota over the entire domain. It just sets an upper limit that non-super admins can set per mailbox.

Well, if the super admin sets the quota on example.com to be 500MB, a non super-admin of example.com can change the quota to 1GB first and the proceed to create 1GB mailboxes.

Originally created by @fabiorauber on GitHub (Apr 14, 2016). Original GitHub issue: https://github.com/opensolutions/ViMbAdmin/issues/181 A non super-admin user can change the max quota for the domain for which he is admin. I believe this is a bug, because the Wiki on Quotas describes max quota as: _NB: maxquota does not define a maximum allowed quota over the entire domain. It just sets an upper limit that non-super admins can set per mailbox._ Well, if the super admin sets the quota on example.com to be 500MB, a non super-admin of example.com can change the quota to 1GB first and the proceed to create 1GB mailboxes.

kerem closed this issue

2026-02-26 09:36:16 +03:00

kerem commented

2026-02-26 09:36:16 +03:00

Author

Owner

@PhrozenByte commented on GitHub (Apr 14, 2016):

IMHO domain admins (non super admins) shouldn't be able to edit domains whatsoever. They should be able to manage mailboxes and aliases and activate/deactivate the domain (i.e. the actions a domain admin can take on the domain overview without navigating to the edit page), but nothing else.

@PhrozenByte commented on GitHub (Apr 14, 2016): IMHO domain admins (non super admins) shouldn't be able to edit domains whatsoever. They should be able to manage mailboxes and aliases and activate/deactivate the domain (i.e. the actions a domain admin can take on the domain overview without navigating to the edit page), but nothing else.

kerem commented

2026-02-26 09:36:17 +03:00

Author

Owner

@click commented on GitHub (Aug 2, 2016):

This is the same as reported in ticket #30, which was closed - @barryo, in the case of non-admins viewing the domain details for quota, might it be easier to just print the value, and not using a editbox?
Verified that the issue still exists in 3.0.15 / master.

@click commented on GitHub (Aug 2, 2016): This is the same as reported in ticket #30, which was closed - @barryo, in the case of non-admins viewing the domain details for quota, might it be easier to just print the value, and not using a editbox? Verified that the issue still exists in 3.0.15 / master.