I added a first reseller and didn't enable all functionality for him. However, when I login with that reseller and add a web template all the functionality that should be disabled is available (in ISPConfig). The only thing that got removed is "DNS Manager", all other functionality (for instance shell access) is still there and the reseller can save the template with that functionality enabled. I haven't checked yet if the customer can make use of it, but shouldn't the disabled functionality be removed from the template?
