PR#999: Allow only repo_admins to assign PRs - pagure

pagure

#999 Allow only repo_admins to assign PRs

Merged 7 years ago by pingou. Opened 7 years ago by ryanlerch.

ryanlerch/pagure restrict-PR-assignment into master

Ensure we test that non-admin cannot assign PR

Pierre-Yves Chibon • 7 years ago

2af4a07

Allow only repo_admins to assign PRs

Ryan Lerch • 7 years ago

deaa7ce

pagure/templates/pull_request.html

file modified

+3 -3

		`@@ -556,7 +556,7 @@`

		`<div class="card">`
		`<div class="card-block">`
		`- {% if authenticated and mergeform and pull_request.status == 'Open' %}`
		`+ {% if authenticated and mergeform and pull_request.status == 'Open' and repo_admin %}`
		`<form method="POST" action="{{ url_for('.set_assignee_requests',`
		`username=username, repo=repo.name, requestid=requestid) }}">`
		`<fieldset class="form-group issue-metadata-form">`
		`@@ -571,10 +571,10 @@`
		`<fieldset class="form-group issue-metadata-display">`
		`<label><strong>Assignee</strong></label>`
		`<div>`
		`- {{ pull_request.assignee.username or '' }}`
		`+ {{ pull_request.assignee.username or 'Unassigned' }}`
		`</div>`
		`</fieldset>`
		`- {% if authenticated and mergeform and pull_request.status == 'Open' %}`
		`+ {% if authenticated and mergeform and pull_request.status == 'Open' and repo_admin %}`
		`<input type="submit" class="btn btn-primary issue-metadata-form" value="Update">`
		`<a class="btn btn-secondary issue-metadata-form editmetadatatoggle" >cancel</a>`
		`</form>`

pagure/ui/fork.py

file modified

		`@@ -799,6 +799,9 @@`
		`if request.status != 'Open':`
		`flask.abort(403, 'Pull-request closed')`

		`+ if not is_repo_admin(repo):`
		`+ flask.abort(403, 'You are not allowed to assign this pull-request')`
		`+`
		`form = pagure.forms.ConfirmationForm()`
		`if form.validate_on_submit():`
		`try:`

tests/test_pagure_flask_ui_fork.py

file modified

+15 -6

		`@@ -1173,10 +1173,10 @@`
		`os.path.join(tests.HERE, 'requests'), bare=True)`
		`self.set_up_git_repo(new_project=None, branch_from='feature')`

		`- # No such project`
		`user = tests.FakeUser()`
		`- user.username = 'foo'`
		`+ user.username = 'pingou'`
		`with tests.user_set(pagure.APP, user):`
		`+ # No such project`
		`output = self.app.post('/foo/pull-request/1/assign')`
		`self.assertEqual(output.status_code, 404)`

		`@@ -1192,7 +1192,7 @@`
		`'Pagure</title>', output.data)`
		`self.assertIn(`
		`'<h3><span class="label label-default">PR#1</span>\n'`
		`- ' PR from the feature branch\n</h3>', output.data)`
		`+ ' PR from the feature branch\n', output.data)`
		`self.assertNotIn(`
		`'</button>\n Request assigned',`
		`output.data)`
		`@@ -1217,7 +1217,7 @@`
		`'Pagure</title>', output.data)`
		`self.assertIn(`
		`'<h3><span class="label label-default">PR#1</span>\n'`
		`- ' PR from the feature branch\n</h3>', output.data)`
		`+ ' PR from the feature branch\n', output.data)`
		`self.assertNotIn(`
		`'</button>\n Request assigned',`
		`output.data)`
		`@@ -1237,7 +1237,7 @@`
		`'Pagure</title>', output.data)`
		`self.assertIn(`
		`'<h3><span class="label label-default">PR#1</span>\n'`
		`- ' PR from the feature branch\n</h3>', output.data)`
		`+ ' PR from the feature branch\n', output.data)`
		`self.assertIn(`
		`'</button>\n No user "bar" found',`
		`output.data)`
		`@@ -1248,6 +1248,15 @@`
		`'user': 'pingou',`
		`}`

		`+ user.username = 'foo'`
		`+ with tests.user_set(pagure.APP, user):`
		`+ output = self.app.post(`
		`+ '/test/pull-request/1/assign', data=data,`
		`+ follow_redirects=True)`
		`+ self.assertEqual(output.status_code, 403)`
		`+`
		`+ user.username = 'pingou'`
		`+ with tests.user_set(pagure.APP, user):`
		`output = self.app.post(`
		`'/test/pull-request/1/assign', data=data,`
		`follow_redirects=True)`
		`@@ -1257,7 +1266,7 @@`
		`'Pagure</title>', output.data)`
		`self.assertIn(`
		`'<h3><span class="label label-default">PR#1</span>\n'`
		`- ' PR from the feature branch\n</h3>', output.data)`
		`+ ' PR from the feature branch\n', output.data)`
		`self.assertIn(`
		`'</button>\n Request assigned',`
		`output.data)`