From ae92283730f6f242cb0e71dedd7a44b58ccaf566 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Feb 09 2018 09:38:58 +0000
Subject: Fix editing and deleting comments added by the EV server to PRs


Basically, we had the project url hard-coded in the html instead of have
it automatically generated from the content passed on by the EV server
so editing a comment added by the EV server was only ever going to work
on a one project.

In addition, the form and csrf token were missing to allow the delete
button to work.
Both form and csrf token are now present on the html page, thus allowing
to right away delete a generic comment that was added by the EV server.

Fixes https://pagure.io/pagure/issue/2958

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/lib/__init__.py b/pagure/lib/__init__.py
index 29d1841..1bfda0a 100644
--- a/pagure/lib/__init__.py
+++ b/pagure/lib/__init__.py
@@ -1238,6 +1238,7 @@ def add_pull_request_comment(session, request, commit, tree_id, filename,
             'comment_added': comment_text,
             'comment_user': pr_comment.user.user,
             'comment_id': pr_comment.id,
+            'project': request.project.fullname,
             'avatar_url': avatar_url_from_email(
                 pr_comment.user.default_email, size=16),
             'comment_date': pr_comment.date_created.strftime(
diff --git a/pagure/static/request_ev.js b/pagure/static/request_ev.js
index 66d36ba..58219c5 100644
--- a/pagure/static/request_ev.js
+++ b/pagure/static/request_ev.js
@@ -2,7 +2,7 @@ add_comment = function(data, username) {
   console.log('Adding comment ' + data.comment_added);
   var field = $('#comments');
   var edit_btn = '<a class="btn btn-secondary btn-sm edit_btn" \
-        href="/test/pull-request/' + data.request_id + '/comment/' + data.comment_id + '/edit" \
+        href="/' + data.project + '/pull-request/' + data.request_id + '/comment/' + data.comment_id + '/edit" \
         data-comment="' + data.comment_id + '" \
         data-objid="' + data.request_id + '"> \
         <span class="oi" data-glyph="pencil"></span> \
@@ -61,41 +61,46 @@ add_comment = function(data, username) {
         </div></div></div> \
         </td></tr>';
   } else {
-  var _data = '<div class="card clearfix"> \
-    <div id="comment-' + data.comment_id + '" class="card-header"> \
-    <img class="avatar circle" src="' + data.avatar_url + '"/> \
-    <a href="/user/' + data.comment_user + '"> ' + data.comment_user + '\
-      </a> \
-      <a class="headerlink pull-xs-right" title="Permalink to this headline" \
-        href="#comment-' + data.comment_id + '"> \
-        <span title="">seconds ago</span> \
-       </a>\
-    </div>\
-    <div class="card-block">\
-      <section class="issue_comment"> \
-        <div class="comment_body"> \
-          <span class="edit_date" title=""> \
-          </span>'
-        + emojione.toImage(data.comment_added) + '\
-        </div> \
-      </section> \
-      <div class="issue_actions m-t-2"> \
-        <div class="issue_action icon pull-xs-right p-b-1"> \
-          <div class="btn-group" role="group" aria-label="Basic example"> \
-            <a class="reply btn btn-secondary btn-sm" data-toggle="tooltip" title="Reply to this comment - lose formatting"> \
-              <span class="oi" data-glyph="share-boxed"></span> \
-            </a>';
-    if ( data.comment_user == username) {
-        _data += edit_btn +
-            '<button class="btn btn-secondary btn-sm" type="submit" name="drop_comment" value="' + data.comment_id + '" \
-                onclick="return confirm(\'Do you really want to remove this comment?\');" \
-                title="Remove comment"> \
-                <span class="oi" data-glyph="trash"></span> \
-            </button>';
-    }
-    _data += '</div> \
-        </div> \
-    </div>';
+    var _csrf = $('#csrf_token').clone();
+    var _data = '<form action="/' + data.project + '/pull-request/' +  data.request_id
+        + '/comment/drop" method="post" onsubmit="return try_async_comment(this, null)"> \
+        <div class="card clearfix"> \
+            <div id="comment-' + data.comment_id + '" class="card-header"> \
+            <img class="avatar circle" src="' + data.avatar_url + '"/> \
+            <a href="/user/' + data.comment_user + '"> ' + data.comment_user + '\
+              </a> \
+              <a class="headerlink pull-xs-right" title="Permalink to this headline" \
+                href="#comment-' + data.comment_id + '"> \
+                <span title="">seconds ago</span> \
+               </a>\
+            </div>\
+            <div class="card-block">\
+              <section class="issue_comment"> \
+                <div class="comment_body"> \
+                  <span class="edit_date" title=""> \
+                  </span>'
+                + emojione.toImage(data.comment_added) + '\
+                </div> \
+              </section> \
+              <div class="issue_actions m-t-2"> \
+                <div class="issue_action icon pull-xs-right p-b-1"> \
+                  <div class="btn-group" role="group" aria-label="Basic example"> \
+                    <a class="reply btn btn-secondary btn-sm" data-toggle="tooltip" title="Reply to this comment - lose formatting"> \
+                      <span class="oi" data-glyph="share-boxed"></span> \
+                    </a>';
+            if ( data.comment_user == username) {
+                _data += edit_btn +
+                    '<button class="btn btn-secondary btn-sm" type="submit" name="drop_comment" value="' + data.comment_id + '" \
+                        onclick="return confirm(\'Do you really want to remove this comment?\');" \
+                        title="Remove comment"> \
+                        <span class="oi" data-glyph="trash"></span> \
+                    </button>';
+            }
+            _data += '</div> \
+                </div> \
+            </div> \
+        <input id="csrf_token" name="csrf_token" value="' + _csrf.val() + '" type="hidden"> \
+        </form>';
   }
 
   if (inline){