From 5a9d2e9b4280438d29a3d12f117561c0173bd2a6 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Sep 30 2016 14:48:46 +0000
Subject: [PATCH 1/2] Let only project admins create repo


Fixes https://pagure.io/pagure/issue/1335

---

diff --git a/pagure/templates/issues.html b/pagure/templates/issues.html
index 2159d21..aafee81 100644
--- a/pagure/templates/issues.html
+++ b/pagure/templates/issues.html
@@ -270,6 +270,8 @@
     </tbody>
 </table>
 </div>
+
+{% if g.repo_admin %}
 <button type="button" class="btn btn-secondary btn-sm pull-xs-right"
   data-toggle="modal" data-target="#report_modal">
   Save report
@@ -303,6 +305,7 @@
     </div>
   </div>
 </div>
+{% endif %}
 
 {{ pagination_link('page', g.page, total_page) }}
 
diff --git a/pagure/ui/issues.py b/pagure/ui/issues.py
index 8c7de4e..6217af6 100644
--- a/pagure/ui/issues.py
+++ b/pagure/ui/issues.py
@@ -1159,6 +1159,10 @@ def edit_comment_issue(
 def save_reports(repo, username=None, namespace=None):
     """ Marked for watching or Unwatching
     """
+    if not flask.g.repo_admin:
+        flask.abort(
+            403,
+            'You are not allowed to create reports for this project')
 
     return_point = flask.url_for(
         'view_issues', repo=repo, username=username, namespace=namespace)

From 260ea2fea27a9147406d836a0aabe5f6165d8d06 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Sep 30 2016 14:54:13 +0000
Subject: [PATCH 2/2] Fix unit-tests :)


---

diff --git a/tests/test_pagure_flask_ui_issues.py b/tests/test_pagure_flask_ui_issues.py
index 88c14d4..73e5b6e 100644
--- a/tests/test_pagure_flask_ui_issues.py
+++ b/tests/test_pagure_flask_ui_issues.py
@@ -571,7 +571,8 @@ class PagureFlaskIssuestests(tests.Modeltests):
             self.assertIn(
                 '<small><p><a href="{app_url}/user/pingou"> '
                 '@pingou</a> changed the status to <code>Fixed</code>'
-                '</p></small>'.format(app_url=pagure.APP.config['APP_URL']),
+                '</p></small>'.format(
+                    app_url=pagure.APP.config['APP_URL'].rstrip('/')),
                 output.data)
 
             # Add new comment