diff --git a/admin/freeposte/admin/templates/manager/list.html b/admin/freeposte/admin/templates/manager/list.html index 23ef317f..d1c9da2d 100644 --- a/admin/freeposte/admin/templates/manager/list.html +++ b/admin/freeposte/admin/templates/manager/list.html @@ -22,7 +22,7 @@ Manager list {% for manager in domain.managers %} - + {{ manager }} diff --git a/admin/freeposte/admin/views/managers.py b/admin/freeposte/admin/views/managers.py index 793b974e..7e464c48 100644 --- a/admin/freeposte/admin/views/managers.py +++ b/admin/freeposte/admin/views/managers.py @@ -37,18 +37,17 @@ def manager_create(domain_name): domain=domain, form=form) -# TODO For now the deletion behaviour is broken and reserved to -# global admins. -@app.route('/manager/delete/', methods=['GET', 'POST']) -@access.confirmation_required("remove manager {manager}") -@access.global_admin -def manager_delete(manager): - user = models.User.query.get(manager) - if user in user.domain.managers: - user.domain.managers.remove(user) +@app.route('/manager/delete//', methods=['GET', 'POST']) +@access.confirmation_required("remove manager {user_email}") +@access.domain_admin(models.Domain, 'domain_name') +def manager_delete(domain_name, user_email): + domain = models.Domain.query.get(domain_name) or flask.abort(404) + user = models.User.query.get(user_email) or flask.abort(404) + if user in domain.managers: + domain.managers.remove(user) db.session.commit() - flask.flash('User %s can no longer manager %s' % (user, user.domain)) + flask.flash('User %s can no longer manager %s' % (user, domain)) else: flask.flash('User %s is not manager' % user, 'error') return flask.redirect( - flask.url_for('.manager_list', domain_name=user.domain.name)) + flask.url_for('.manager_list', domain_name=domain_name))