From 7cb23b14f6483e6a924a3fcd9301e8caeead81ac Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Nov 17 2016 22:18:10 +0000
Subject: [PATCH 1/2] Only let admins edit the dependency tree of issues


Otherwise, the information are edited while the user does not have rights
to edit them, ie: does not have access to the form, which in practie
means that the information is removed.

Fixes https://pagure.io/pagure/issue/1551

---

diff --git a/pagure/ui/issues.py b/pagure/ui/issues.py
index 3ae3542..82f1a49 100644
--- a/pagure/ui/issues.py
+++ b/pagure/ui/issues.py
@@ -274,19 +274,19 @@ def update_issue(repo, issueid, username=None, namespace=None):
                             SESSION, issue, key, value)
                     )
 
-            # Update ticket this one depends on
-            messages.union(set(pagure.lib.update_dependency_issue(
-                SESSION, repo, issue, depends,
-                username=flask.g.fas_user.username,
-                ticketfolder=APP.config['TICKETS_FOLDER'],
-            )))
+                # Update ticket this one depends on
+                messages.union(set(pagure.lib.update_dependency_issue(
+                    SESSION, repo, issue, depends,
+                    username=flask.g.fas_user.username,
+                    ticketfolder=APP.config['TICKETS_FOLDER'],
+                )))
 
-            # Update ticket(s) depending on this one
-            messages.union(set(pagure.lib.update_blocked_issue(
-                SESSION, repo, issue, blocks,
-                username=flask.g.fas_user.username,
-                ticketfolder=APP.config['TICKETS_FOLDER'],
-            )))
+                # Update ticket(s) depending on this one
+                messages.union(set(pagure.lib.update_blocked_issue(
+                    SESSION, repo, issue, blocks,
+                    username=flask.g.fas_user.username,
+                    ticketfolder=APP.config['TICKETS_FOLDER'],
+                )))
 
             if not is_js:
                 for message in messages:

From 349f0bb5228e1b992cfa3ca3c338480ff11a9bd1 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Nov 17 2016 22:18:32 +0000
Subject: [PATCH 2/2] Add unit-test ensuring non-admin user cannot edit dependency info


---

diff --git a/tests/test_pagure_flask_ui_issues.py b/tests/test_pagure_flask_ui_issues.py
index 4a223ea..5bf8a1d 100644
--- a/tests/test_pagure_flask_ui_issues.py
+++ b/tests/test_pagure_flask_ui_issues.py
@@ -1056,6 +1056,35 @@ class PagureFlaskIssuestests(tests.Modeltests):
         self.session.commit()
         self.assertEqual(msg.title, 'Test issue #2')
 
+        # User is not an admin of the project
+        user = tests.FakeUser(username='foo')
+        with tests.user_set(pagure.APP, user):
+            output = self.app.get('/test/issue/1')
+            self.assertEqual(output.status_code, 200)
+            self.assertIn(
+                '<title>Issue #1: Test issue - test - Pagure</title>',
+                output.data)
+
+            csrf_token = output.data.split(
+                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+
+            # Add a dependent ticket
+            data = {
+                'csrf_token': csrf_token,
+                'blocks': '2',
+            }
+            output = self.app.post(
+                '/test/issue/1/update', data=data, follow_redirects=True)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn(
+                '<title>Issue #1: Test issue - test - Pagure</title>',
+                output.data)
+
+            repo = pagure.lib.get_project(self.session, 'test')
+            issue = pagure.lib.search_issues(self.session, repo, issueid=1)
+            self.assertEqual(issue.depends_text, [])
+            self.assertEqual(issue.blocks_text, [])
+
         user = tests.FakeUser()
         user.username = 'pingou'
         with tests.user_set(pagure.APP, user):