Repository: modoboa/modoboa

Issue:
Disabled account can still receive email
# Impacted versions

* OS Type: Debian
* OS Version: Buster
* Database Type: PostgreSQL
* Database version: 11
* Modoboa: 1.17.0

# Steps to reproduce

1. Create an account with _Simple user_ role and disable it - either at the creation or after
2. Send an email to this account

# Current behavior

Even if the account is disabled, the recipient is still allowed by Postfix and the email is delivered.

# Expected behavior

If I understand the meaning of a disabled account, emails to this address should be rejected.

# Debugging

While trying to find in Postfix when this recipient is accepted, I found that it was by looking up in `sql-aliases.cf` table. Even if there is a condition on `enabled` in the `admin_alias` table, the object is still returned. And indeed, even if the `core_user` is disabled, the corresponding `admin_alias` is not.
Disabled account can still receive email
# Impacted versions

* OS Type: Debian
* OS Version: Buster
* Database Type: PostgreSQL
* Database version: 11
* Modoboa: 1.17.0

# Steps to reproduce

1. Create an account with _Simple user_ role and disable it - either at the creation or after
2. Send an email to this account

# Current behavior

Even if the account is disabled, the recipient is still allowed by Postfix and the email is delivered.

# Expected behavior

If I understand the meaning of a disabled account, emails to this address should be rejected.

# Debugging

While trying to find in Postfix when this recipient is accepted, I found that it was by looking up in `sql-aliases.cf` table. Even if there is a condition on `enabled` in the `admin_alias` table, the object is still returned. And indeed, even if the `core_user` is disabled, the corresponding `admin_alias` is not.


Discussion:
Hi,

I Cant reproduce. 

When i send mail to desactivated user, it's reject.

Regard

PS : Manual installed server
Thanks @cyberal77 to give it a try! Are you also using the last Modoba's version? I encounter that on manual installations too, but my Postfix configuration is almost the same as the automatic installer's one. Anyway, from what I understood, I don't think this is related.

Could you also check that the corresponding `admin_alias`'s object is also disabled please? For example, here is what I have in a shell:
```python
>>> from modoboa.core.models import User
>>> from modoboa.admin.models import Alias

>>> u = User.objects.get(email='user2@example.org')
>>> u.enabled
False
>>> a = Alias.objects.get(address=u.email)
>>> a.enabled
True
>>> a.internal
True
```
Hi @jeromelebleu 

It seem that @tonioo fix the problem in this [commit](https://github.com/modoboa/modoboa/commit/1aed875f6865046a0d538a1a0772e50962987789) can you retry ?

Regards,
Hi @kryskool, no it does not fix this problem and this is why I commented this commit. It only disables aliases which have been added *manually* from the interface (`internal=False`) and not automatically like here (`internal=True`).
Hi,

I Cant reproduce. 

When i send mail to desactivated user, it's reject.

Regard

PS : Manual installed server
Thanks @cyberal77 to give it a try! Are you also using the last Modoba's version? I encounter that on manual installations too, but my Postfix configuration is almost the same as the automatic installer's one. Anyway, from what I understood, I don't think this is related.

Could you also check that the corresponding `admin_alias`'s object is also disabled please? For example, here is what I have in a shell:
```python
>>> from modoboa.core.models import User
>>> from modoboa.admin.models import Alias

>>> u = User.objects.get(email='user2@example.org')
>>> u.enabled
False
>>> a = Alias.objects.get(address=u.email)
>>> a.enabled
True
>>> a.internal
True
```
Hi @jeromelebleu 

It seem that @tonioo fix the problem in this [commit](https://github.com/modoboa/modoboa/commit/1aed875f6865046a0d538a1a0772e50962987789) can you retry ?

Regards,
Hi @kryskool, no it does not fix this problem and this is why I commented this commit. It only disables aliases which have been added *manually* from the interface (`internal=False`) and not automatically like here (`internal=True`).

Resolving patch:
diff --git a/modoboa/admin/forms/account.py b/modoboa/admin/forms/account.py
--- a/modoboa/admin/forms/account.py
+++ b/modoboa/admin/forms/account.py
@@ -206,9 +206,8 @@ def save(self, commit=True):
             account.role = self.cleaned_data["role"]
             if hasattr(account, "mailbox"):
                 # Update forward status according to account status
-                models.Alias.objects.filter(
-                    address=account.email, internal=False).update(
-                        enabled=account.is_active)
+                models.Alias.objects.filter(address=account.email).update(
+                    enabled=account.is_active)
         return account
 
 


Test patch:
diff --git a/modoboa/admin/tests/test_account.py b/modoboa/admin/tests/test_account.py
--- a/modoboa/admin/tests/test_account.py
+++ b/modoboa/admin/tests/test_account.py
@@ -119,8 +119,10 @@ def test_create_account_default_lang(self):
         account = User.objects.get(username=values["username"])
         self.assertEqual(account.language, "fr")
 
-    def test_forward_updated_on_edit(self):
+    def test_aliases_update_on_disable(self):
+        """Check if aliases are updated when account is disabled."""
         account = User.objects.get(username="user@test.com")
+        internal = models.Alias.objects.get(address=account.email, internal=True)
         forward = models.Alias.objects.create(address=account.email, internal=False)
         values = {
             "username": "user@test.com",
@@ -133,12 +135,16 @@ def test_forward_updated_on_edit(self):
         self.ajax_post(
             reverse("admin:account_change", args=[account.id]), values
         )
+        internal.refresh_from_db()
+        self.assertFalse(internal.enabled)
         forward.refresh_from_db()
         self.assertFalse(forward.enabled)
         values["is_active"] = True
         self.ajax_post(
             reverse("admin:account_change", args=[account.id]), values
         )
+        internal.refresh_from_db()
+        self.assertTrue(internal.enabled)
         forward.refresh_from_db()
         self.assertTrue(forward.enabled)