From 28a4c1e9718744de5b8ee343df5ab6e78cfcde4c Mon Sep 17 00:00:00 2001 From: Jessica McKellar Date: Thu, 8 Aug 2013 16:50:08 -0400 Subject: [PATCH] Give API superusers the ability to send messages to arbitrary realms. (imported from commit e7d1e89844cd2c32c14ad852d848e93b5861eac1) --- zerver/views.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/zerver/views.py b/zerver/views.py index 0a6958ea6f..7b9715f93e 100644 --- a/zerver/views.py +++ b/zerver/views.py @@ -1158,12 +1158,23 @@ def send_message_backend(request, user_profile, message_to = REQ('to', converter=extract_recipients), forged = REQ(default=False), subject_name = REQ('subject', lambda x: x.strip(), None), - message_content = REQ('content')): + message_content = REQ('content'), + domain = REQ('domain', default=None)): client = request.client is_super_user = is_super_user_api(request) if forged and not is_super_user: return json_error("User not authorized for this query") + realm = None + if domain: + if not is_super_user: + # The email gateway bot needs to be able to send messages in + # any realm. + return json_error("User not authorized for this query") + realm = get_realm(domain) + if not realm: + return json_error("Unknown domain " + domain) + if client.name == "zephyr_mirror": # Here's how security works for non-superuser mirroring: # @@ -1192,7 +1203,7 @@ def send_message_backend(request, user_profile, ret = check_send_message(sender, client, message_type_name, message_to, subject_name, message_content, forged=forged, forged_timestamp = request.POST.get('time'), - forwarder_user_profile=user_profile) + forwarder_user_profile=user_profile, realm=realm) if ret is not None: return json_error(ret) return json_success()