Yikes. :thumbsup:

I know this is getting into the weeds a bit and isn't really what this PR is about, but shouldn't the server respond with a 403 or something if you try to update things you don't have the permission to do rather than silently not doing them?

I just have that one comment on the test, but this looks good. If you agree with the inline comment, we can file a ticket.

In theory I would agree with you but in this case we use the same endpoint for all the action on an issue page, including adding a comment. So we can't return a 403 since commenting is valid. What we want to avoid is that by commenting people change other fields because the logic is flawed (in this case) and it checks what was sent (here nothing) and update with that (ie: here drop the dependency).

Doing some code refactoring around that method should help and make it more obvious what's going on.

I have opened a ticket https://pagure.io/pagure/issue/1590 to keep track of the idea of cleaning this part of the code.

I would like to proceed with merging this PR. I filed a ticket about restructure this part of the code but that shouldn't influence this fix which we need.

I hope you're ok with this.