avoid admin permissions to access everything as well

dimagi · Dec 17, 2018 · 1518a4a · 1518a4a
1 parent 0fb9573
commit 1518a4a
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/corehq/apps/users/models.py b/corehq/apps/users/models.py
@@ -652,6 +652,9 @@ def has_permission(self, domain, permission, data=None, restrict_global_admin=Fa
 
         dm = self.get_domain_membership(domain)
         if dm:
+            # an admin has access to all features by default, restrict that if needed
+            if dm.is_admin and restrict_global_admin:
+                return False
             return dm.has_permission(permission, data)
         else:
             return False