can edit his own identiy like an admin
can add aliases for any domain (even when not listed, but available on the server)
can add sender addresses for any domain

Expected behavior

Should not be able to edit is own identity at all.
Should only be able to edit all identies under the domain where permission is granted

open

not checked if it is possible to add identities outside his domains

Originally created by @msenebald on GitHub (Apr 17, 2017). Original GitHub issue: https://github.com/modoboa/modoboa/issues/1100 Originally assigned to: @tonioo on GitHub. # Impacted versions * Modoboa: 1.7.2 * installer used: Yes * Webserver: Nginx # Steps to reproduce Account with domainadmin rights accountname: domainadmin@example.com permissions for domain: subdomain.example.com resource: mailbox aliases >0 # Current behavior Domainadmin@example.com - can edit his own identiy like an admin - can add aliases for any domain (even when not listed, but available on the server) - can add sender addresses for any domain # Expected behavior Should not be able to edit is own identity at all. Should only be able to edit all identies under the domain where permission is granted # open not checked if it is possible to add identities outside his domains

kerem

2026-02-27 11:14:15 +03:00

closed this issue
added the
bug

security
labels

kerem commented

2026-02-27 11:14:16 +03:00

Author

Owner

@tonioo commented on GitHub (Apr 20, 2017):

@msenebald I've fixed alias and sender address issues, thank you for reporting.

Where is the problem in allowing the domain admin to edit its own information?

@tonioo commented on GitHub (Apr 20, 2017): @msenebald I've fixed alias and sender address issues, thank you for reporting. Where is the problem in allowing the domain admin to edit its own information?

kerem commented

2026-02-27 11:14:16 +03:00

Author

Owner

@tonioo commented on GitHub (Apr 20, 2017):

@msenebald I close this issue. Feel free to open a new one about the self-edition issue.

@tonioo commented on GitHub (Apr 20, 2017): @msenebald I close this issue. Feel free to open a new one about the self-edition issue.

kerem commented

2026-02-27 11:14:16 +03:00

Author

Owner

@msenebald commented on GitHub (Apr 21, 2017):

Nice! Thanks for the fix. I'll check the self edit options in more detail with this patch to verify if worth another ticket. From code it seems already fine.

@msenebald commented on GitHub (Apr 21, 2017): Nice! Thanks for the fix. I'll check the self edit options in more detail with this patch to verify if worth another ticket. From code it seems already fine.

kerem referenced this issue

2026-02-27 11:20:42 +03:00

[PR #918] [MERGED] Contributing #2056