From c9ba9943124b6f86cd430f2b4c8424863ea88be8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9ters?= <fpeters@entrouvert.com>
Date: Wed, 11 Dec 2019 14:10:39 +0100
Subject: [PATCH] misc: do not let internal roles grant access to backoffice
 (#38409)

---
 wcs/ctl/hobo_notify.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/wcs/ctl/hobo_notify.py b/wcs/ctl/hobo_notify.py
index 0ee545998..7c8cb2be1 100644
--- a/wcs/ctl/hobo_notify.py
+++ b/wcs/ctl/hobo_notify.py
@@ -136,6 +136,7 @@ class CmdHoboNotify(Command):
                 role.emails_to_members = emails_to_members
                 if role.slug.startswith('_'):
                     role.internal = True
+                    role.allows_backoffice_access = False
                 role.store()
             elif action == 'deprovision':
                 # Deprovision