From 18429cfd29507582cdedce298226a3d2f271f81d Mon Sep 17 00:00:00 2001
From: sahil839 <sahilbatra839@gmail.com>
Date: Fri, 12 Jun 2020 00:46:53 +0530
Subject: [PATCH] realm: Allow only owners to set message retention policy for
 a realm.

This commits adds restriction on admins to set message retention policy.
We now only allow only organization owners to set message retention
policy.

Dropdown for changing retention policy is disabled in UI for admins also.
---
 static/js/settings_org.js                                 | 1 +
 static/templates/settings/organization_settings_admin.hbs | 5 ++++-
 templates/zerver/help/message-retention-policy.md         | 2 ++
 zerver/tests/test_realm.py                                | 8 +++++++-
 zerver/views/realm.py                                     | 2 ++
 5 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/static/js/settings_org.js b/static/js/settings_org.js
index de719bb45e..5fe8b3fa76 100644
--- a/static/js/settings_org.js
+++ b/static/js/settings_org.js
@@ -23,6 +23,7 @@ exports.maybe_disable_widgets = function () {
 
     if (page_params.is_admin) {
         $("#deactivate_realm_button").attr("disabled", true);
+        $("#org-message-retention").find("input, select").attr("disabled", true);
         return;
     }
 
diff --git a/static/templates/settings/organization_settings_admin.hbs b/static/templates/settings/organization_settings_admin.hbs
index dd3f1ca9f7..13d34c03ba 100644
--- a/static/templates/settings/organization_settings_admin.hbs
+++ b/static/templates/settings/organization_settings_admin.hbs
@@ -150,7 +150,10 @@
 
             <div class="inline-block organization-settings-parent">
                 <div class="input-group">
-                    <label for="id_realm_message_retention_setting" class="dropdown-title">{{t "Message retention period" }}</label>
+                    <label for="id_realm_message_retention_setting" class="dropdown-title">{{t "Message retention period" }}
+                        <i class="fa fa-info-circle settings-info-icon realm_allow_message_deleting_tooltip" data-toggle="tooltip"
+                          aria-hidden="true" title="{{t 'Only owners can change message retention policy.' }}"></i>
+                    </label>
                     <select name="realm_message_retention_setting"
                       id="id_realm_message_retention_setting" class="prop-element"
                       {{#unless zulip_plan_is_not_limited}}disabled{{/unless}}>
diff --git a/templates/zerver/help/message-retention-policy.md b/templates/zerver/help/message-retention-policy.md
index 3a48f35126..8e004b55ce 100644
--- a/templates/zerver/help/message-retention-policy.md
+++ b/templates/zerver/help/message-retention-policy.md
@@ -1,5 +1,7 @@
 # Message retention policy (beta)
 
+{!owner-only.md!}
+
 By default, Zulip stores messages indefinitely, allowing full-text
 search of your complete history.
 
diff --git a/zerver/tests/test_realm.py b/zerver/tests/test_realm.py
index b492534fd5..6eee9f1f1b 100644
--- a/zerver/tests/test_realm.py
+++ b/zerver/tests/test_realm.py
@@ -634,6 +634,12 @@ class RealmTest(ZulipTestCase):
         realm = get_realm('zulip')
         self.assertEqual(realm.plan_type, Realm.SELF_HOSTED)
 
+        req = dict(message_retention_days=ujson.dumps(10))
+        result = self.client_patch('/json/realm', req)
+        self.assert_json_error(result, "Only organization owners can change message retention period.")
+
+        self.login('desdemona')
+
         req = dict(message_retention_days=ujson.dumps(0))
         result = self.client_patch('/json/realm', req)
         self.assert_json_error(result, "Bad value for 'message_retention_days': 0")
@@ -666,7 +672,7 @@ class RealmAPITest(ZulipTestCase):
 
     def setUp(self) -> None:
         super().setUp()
-        self.login('iago')
+        self.login('desdemona')
 
     def set_up_db(self, attr: str, value: Any) -> None:
         realm = get_realm('zulip')
diff --git a/zerver/views/realm.py b/zerver/views/realm.py
index 6a43106ba6..657d09dc58 100644
--- a/zerver/views/realm.py
+++ b/zerver/views/realm.py
@@ -113,6 +113,8 @@ def update_realm(
             return json_error(_('Invalid domain: {}').format(e.messages[0]))
 
     if message_retention_days is not None:
+        if not user_profile.is_realm_owner:
+            return json_error(_("Only organization owners can change message retention period."))
         realm.ensure_not_on_limited_plan()
 
     # The user of `locals()` here is a bit of a code smell, but it's