kallithea Changeset - 162bf5c978f8

Changeset - 162bf5c978f8

Parent rev.

Child rev.

[Not reviewed]

beta

0 3 0

Marcin Kuzminski - 14 years ago 2012-03-29 21:21:29
marcin@python-works.com

fixed missing permissions check on forks page

3 files changed with 63 insertions and 9 deletions:

docs/changelog.rst

rhodecode/controllers/forks.py

rhodecode/tests/functional/test_forks.py

0 comments (0 inline, 0 general)

docs/changelog.rst

➞

Show inline comments

@@ @@ -10,24 +10,25 @@ Changelog @@
 :status: in-progress
 :branch: beta
 news
 ++++
 - use ext_json for json module
 fixes
 +++++
 - fixed dev-version marker for stable when served from source codes
 - fixed missing permission checks on show forks page
 .3.4 (**2012-03-28**)
 ----------------------
 news
 ++++
 - Whoosh logging is now controlled by the .ini files logging setup
 - added clone-url into edit form on /settings page
 - added help text into repo add/edit forms
 - created rcextensions module with additional mappings (ref #322) and
   post push/pull/create repo hooks callbacks

rhodecode/controllers/forks.py

➞

Show inline comments

@@ @@ -26,25 +26,25 @@ import logging @@
 import formencode
 import traceback
 from formencode import htmlfill
 from pylons import tmpl_context as c, request, url
 from pylons.controllers.util import redirect
 from pylons.i18n.translation import _
 import rhodecode.lib.helpers as h
 from rhodecode.lib.helpers import Page
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator, \
     NotAnonymous
+    NotAnonymous, HasRepoPermissionAny
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.model.db import Repository, RepoGroup, UserFollowing, User
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.forms import RepoForkForm
 log = logging.getLogger(__name__)
 class ForksController(BaseRepoController):
     @LoginRequired()
     def __before__(self):
@@ @@ -94,25 +94,31 @@ class ForksController(BaseRepoController @@
                                             c.repo_last_rev) * 100)
         defaults = RepoModel()._get_defaults(repo_name)
         # add prefix to fork
         defaults['repo_name'] = 'fork-' + defaults['repo_name']
         return defaults
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def forks(self, repo_name):
         p = int(request.params.get('page', 1))
         repo_id = c.rhodecode_db_repo.repo_id
         d = Repository.get_repo_forks(repo_id)
         d = []
         for r in Repository.get_repo_forks(repo_id):
             if not HasRepoPermissionAny(
                 'repository.read', 'repository.write', 'repository.admin'
             )(r.repo_name, 'get forks check'):
                 continue
             d.append(r)
         c.forks_pager = Page(d, page=p, items_per_page=20)
         c.forks_data = render('/forks/forks_data.html')
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             return c.forks_data
         return render('/forks/forks.html')
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')

rhodecode/tests/functional/test_forks.py

➞

Show inline comments

 from rhodecode.tests import *
 from rhodecode.model.db import Repository
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.user import UserModel
 class TestForksController(TestController):
     def setUp(self):
         self.username = u'forkuser'
         self.password = u'qweqwe'
         self.u1 = UserModel().create_or_update(
             username=self.username, password=self.password,
             email=u'fork_king@rhodecode.org', name=u'u1', lastname=u'u1'
+        )
         self.Session.commit()
     def tearDown(self):
         self.Session.delete(self.u1)
         self.Session.commit()
     def test_index(self):
         self.log_user()
         repo_name = HG_REPO
         response = self.app.get(url(controller='forks', action='forks',
                                     repo_name=repo_name))
         self.assertTrue("""There are no forks yet""" in response.body)
     def test_index_with_fork(self):
         self.log_user()
         # create a fork
         fork_name = HG_FORK
         description = 'fork of vcs test'
         repo_name = HG_REPO
         org_repo = Repository.get_by_repo_name(repo_name)
         response = self.app.post(url(controller='forks',
                                      action='fork_create',
                                     repo_name=repo_name),
                                     {'repo_name':fork_name,
                                      'repo_group':'',
                                      'fork_parent_id':org_repo.repo_id,
                                      'repo_type':'hg',
                                      'description':description,
                                      'private':'False'})
         response = self.app.get(url(controller='forks', action='forks',
                                     repo_name=repo_name))
         self.assertTrue("""<a href="/%s/summary">"""
                          """vcs_test_hg_fork</a>""" % fork_name
                          in response.body)
         #remove this fork
         response = self.app.delete(url('repo', repo_name=fork_name))
     def test_z_fork_create(self):
         self.log_user()
         fork_name = HG_FORK
         description = 'fork of vcs test'
         repo_name = HG_REPO
         org_repo = Repository.get_by_repo_name(repo_name)
         response = self.app.post(url(controller='forks', action='fork_create',
                                     repo_name=repo_name),
                                     {'repo_name':fork_name,
                                      'repo_group':'',
                                      'fork_parent_id':org_repo.repo_id,
                                      'repo_type':'hg',
@@ @@ -62,25 +73,61 @@ class TestForksController(TestController @@
         #test if we have a message that fork is ok
         self.assertTrue('forked %s repository as %s' \
                       % (repo_name, fork_name) in response.session['flash'][0])
         #test if the fork was created in the database
         fork_repo = self.Session.query(Repository)\
             .filter(Repository.repo_name == fork_name).one()
         self.assertEqual(fork_repo.repo_name, fork_name)
         self.assertEqual(fork_repo.fork.repo_name, repo_name)
         #test if fork is visible in the list ?
         response = response.follow()
         # check if fork is marked as fork
         # wait for cache to expire
         import time
         time.sleep(10)
         response = self.app.get(url(controller='summary', action='index',
                                     repo_name=fork_name))
         self.assertTrue('Fork of %s' % repo_name in response.body)
     def test_zz_fork_permission_page(self):
         usr = self.log_user(self.username, self.password)['user_id']
         repo_name = HG_REPO
         forks = self.Session.query(Repository)\
             .filter(Repository.fork_id != None)\
             .all()
         self.assertEqual(1, len(forks))
         # set read permissions for this
         RepoModel().grant_user_permission(repo=forks[0],
                                           user=usr,
                                           perm='repository.read')
         self.Session.commit()
         response = self.app.get(url(controller='forks', action='forks',
                                     repo_name=repo_name))
         response.mustcontain('<div style="padding:5px 3px 3px 42px;">fork of vcs test</div>')
     def test_zzz_fork_permission_page(self):
         usr = self.log_user(self.username, self.password)['user_id']
         repo_name = HG_REPO
         forks = self.Session.query(Repository)\
             .filter(Repository.fork_id != None)\
             .all()
         self.assertEqual(1, len(forks))
         # set none
         RepoModel().grant_user_permission(repo=forks[0],
                                           user=usr, perm='repository.none')
         self.Session.commit()
         # fork shouldn't be there
         response = self.app.get(url(controller='forks', action='forks',
                                     repo_name=repo_name))
         response.mustcontain('There are no forks yet')

0 comments (0 inline, 0 general)