This is an automated email from the git hooks/post-receive script.
praiskup pushed a commit to branch master in repository copr/copr.
The following commit(s) were added to refs/heads/master by this push: new f4b1192 frontend: admin permission check in 'can_build_in()' f4b1192 is described below
commit f4b119283841a29a54b8ff43b8068cebd7a79682 Author: Pavel Raiskup praiskup@redhat.com AuthorDate: Fri Aug 30 08:40:06 2019 +0200
frontend: admin permission check in 'can_build_in()'
Commit 8e8867b5a caused that we didn't compare the admin permissions of the logged user, but the owner of copr we tried to build against.
Fix test-cases which didn't expect that the requesting user may be admin, and add new test-case for the bug itself (that normal user can not build in admin's project).
Fixes: #970 --- frontend/coprs_frontend/coprs/models.py | 2 +- .../tests/test_views/test_coprs_ns/test_coprs_builds.py | 16 +++++++++++++++- .../tests/test_views/test_coprs_ns/test_coprs_general.py | 4 ++-- 3 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/frontend/coprs_frontend/coprs/models.py b/frontend/coprs_frontend/coprs/models.py index cc600c0..ce8c61f 100644 --- a/frontend/coprs_frontend/coprs/models.py +++ b/frontend/coprs_frontend/coprs/models.py @@ -115,7 +115,7 @@ class User(db.Model, helpers.Serializer): """ Determine if this user can build in the given copr. """ - if copr.user.admin: + if self.admin: return True if copr.group: if self.can_build_in_group(copr.group): diff --git a/frontend/coprs_frontend/tests/test_views/test_coprs_ns/test_coprs_builds.py b/frontend/coprs_frontend/tests/test_views/test_coprs_ns/test_coprs_builds.py index 0e98253..0b6d276 100644 --- a/frontend/coprs_frontend/tests/test_views/test_coprs_ns/test_coprs_builds.py +++ b/frontend/coprs_frontend/tests/test_views/test_coprs_ns/test_coprs_builds.py @@ -46,7 +46,9 @@ class TestCoprAddBuild(CoprsTestCase): def test_copr_not_yet_allowed_user_cant_add_build(self, f_users, f_coprs, f_copr_permissions, f_db):
- self.db.session.add_all([self.u2, self.c3]) + self.u1.admin = False + self.db.session.add_all([self.u1, self.u2, self.c3]) + self.test_client.post("/coprs/{0}/{1}/new_build/" .format(self.u2.name, self.c3.name), data={"pkgs": "http://example.com/testing.src.rpm%22%7D, @@ -54,6 +56,18 @@ class TestCoprAddBuild(CoprsTestCase):
assert not self.models.Build.query.first()
+ @TransactionDecorator("u2") + def test_copr_user_cant_add_build_to_admin_project(self, f_users, f_coprs, + f_copr_permissions, f_db): + """ test for issue#970 """ + self.db.session.add_all([self.u1, self.c1]) + self.test_client.post("/coprs/{0}/{1}/new_build/" + .format(self.u1.name, self.c1.name), + data={"pkgs": "http://example.com/testing.src.rpm%22%7D, + follow_redirects=True) + assert not self.models.Build.query.first() + + @TransactionDecorator("u3") def test_copr_user_without_permission_cant_add_build(self, f_users, f_coprs, diff --git a/frontend/coprs_frontend/tests/test_views/test_coprs_ns/test_coprs_general.py b/frontend/coprs_frontend/tests/test_views/test_coprs_ns/test_coprs_general.py index d0fa2b7..3468024 100644 --- a/frontend/coprs_frontend/tests/test_views/test_coprs_ns/test_coprs_general.py +++ b/frontend/coprs_frontend/tests/test_views/test_coprs_ns/test_coprs_general.py @@ -261,8 +261,8 @@ class TestCoprDetail(CoprsTestCase): @TransactionDecorator("u1") def test_copr_detail_doesnt_allow_non_submitter_to_cancel_build( self, f_users, f_coprs, f_mock_chroots, f_builds, f_db): - - self.db.session.add_all([self.u2, self.c2]) + self.u1.admin = False + self.db.session.add_all([self.u1, self.u2, self.c2]) r = self.test_client.get( "/coprs/{0}/{1}/build/{2}/".format(self.u2.name, self.c2.name, self.c2.builds[0].id)) assert b"/cancel_build/" not in r.data
copr-commits@lists.fedorahosted.org