paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-11 01:16:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Give API superusers the ability to send messages to arbitrary realms.

Browse Source 
(imported from commit e7d1e89844cd2c32c14ad852d848e93b5861eac1)
This commit is contained in:
Jessica McKellar
2013-08-08 16:50:08 -04:00
parent 62a20cf0ef
commit 28a4c1e971
1 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
zerver/views.py
View File

@@ -1158,12 +1158,23 @@ def send_message_backend(request, user_profile,
message_to = REQ('to', converter=extract_recipients), message_to = REQ('to', converter=extract_recipients),
forged = REQ(default=False), forged = REQ(default=False),
subject_name = REQ('subject', lambda x: x.strip(), None), subject_name = REQ('subject', lambda x: x.strip(), None),
message_content = REQ('content')): message_content = REQ('content'),
domain = REQ('domain', default=None)):
client = request.client client = request.client
is_super_user = is_super_user_api(request) is_super_user = is_super_user_api(request)
if forged and not is_super_user: if forged and not is_super_user:
return json_error("User not authorized for this query") return json_error("User not authorized for this query")
realm = None
if domain:
if not is_super_user:
# The email gateway bot needs to be able to send messages in
# any realm.
return json_error("User not authorized for this query")
realm = get_realm(domain)
if not realm:
return json_error("Unknown domain " + domain)
if client.name == "zephyr_mirror": if client.name == "zephyr_mirror":
# Here's how security works for non-superuser mirroring: # Here's how security works for non-superuser mirroring:
# #
@@ -1192,7 +1203,7 @@ def send_message_backend(request, user_profile,
ret = check_send_message(sender, client, message_type_name, message_to, ret = check_send_message(sender, client, message_type_name, message_to,
subject_name, message_content, forged=forged, subject_name, message_content, forged=forged,
forged_timestamp = request.POST.get('time'), forged_timestamp = request.POST.get('time'),
forwarder_user_profile=user_profile) forwarder_user_profile=user_profile, realm=realm)
if ret is not None: if ret is not None:
return json_error(ret) return json_error(ret)
return json_success() return json_success()