From 541581aa18e643e1189d317cb267470f1d22988d Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 1/13] Add something in the UI indicating that the project is private


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/templates/repo_master.html b/pagure/templates/repo_master.html
index 4a1580c..734dc0b 100644
--- a/pagure/templates/repo_master.html
+++ b/pagure/templates/repo_master.html
@@ -14,6 +14,10 @@
             repo=repo.name,
             username=username,
             namespace=repo.namespace)}}">
+          {% if repo.private %}
+            <span class="oi red-icon" data-glyph="lock-locked"
+                  title="Private project"></span>
+          {% endif %}
           {% if repo.is_fork -%}
             <span class="oi" data-glyph="fork"></span>
             {{ repo.user.user }}/{{

From 2a81d6d4578ac4cbdc746684aae5c62d0696b38f Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 2/13] Namespace private project when they are created


This way there are much less chances to reveal a private project by
trying to brute force the new project API/code path (which would deny
creating a project if there is already one of the same name but is
private)

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/lib/__init__.py b/pagure/lib/__init__.py
index 6753843..da0d929 100644
--- a/pagure/lib/__init__.py
+++ b/pagure/lib/__init__.py
@@ -1280,6 +1280,9 @@ def new_project(session, user, name, blacklist, allowed_prefix,
         allowed_prefix.append(user)
         if not namespace:
             namespace = user
+    if private:
+        allowed_prefix.append(user)
+        namespace = user
 
     if namespace and namespace not in allowed_prefix:
         raise pagure.exceptions.PagureException(
@@ -1819,6 +1822,7 @@ def fork_project(session, user, repo, gitfolder,
         name=repo.name,
         namespace=repo.namespace,
         description=repo.description,
+        private=repo.private,
         user_id=user_obj.id,
         parent_id=repo.id,
         is_fork=True,
diff --git a/pagure/templates/new_project.html b/pagure/templates/new_project.html
index 8ffb023..fc45aa3 100644
--- a/pagure/templates/new_project.html
+++ b/pagure/templates/new_project.html
@@ -35,3 +35,24 @@
   </div>
 </div>
 {% endblock %}
+
+
+{% if config.get('PRIVATE_PROJECTS', False) %}
+{% block jscripts %}
+{{ super() }}
+<script type="text/javascript">
+var _user = '{{ g.fas_user.username }}';
+$('#private').change(function(){
+  var _private = $('#private').is(':checked');
+  if (_private) {
+    $('#namespace').append($('<option></option>').val(_user).html(_user));
+    $('#namespace').val(_user);
+    $('#namespace').attr("disabled", "disabled");
+  } else {
+    $("#namespace>option[value='" + _user + "']").remove();
+    $('#namespace').removeAttr("disabled");
+  }
+});
+</script>
+{% endblock %}
+{% endif %}
diff --git a/pagure/ui/app.py b/pagure/ui/app.py
index 563180b..9bce789 100644
--- a/pagure/ui/app.py
+++ b/pagure/ui/app.py
@@ -450,6 +450,9 @@ def new_project():
         private = False
         if pagure.APP.config.get('PRIVATE_PROJECTS', False):
             private = form.private.data
+        # Though it's not need for new_project() it fixes the redirect after
+        if private:
+            namespace=flask.g.fas_user.username
 
         try:
             pagure.lib.new_project(

From 6efa0892b1a00c531a24e43a1c258de54453850d Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 3/13] Allow private project to be made public but not the other way around


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/templates/settings.html b/pagure/templates/settings.html
index 7da9140..7b7d0de 100644
--- a/pagure/templates/settings.html
+++ b/pagure/templates/settings.html
@@ -41,7 +41,7 @@
               <input class="form-control" name="tags" value="{{ repo.tags_text |join(', ') if repo.tags else '' }}" />
               <small class="text-muted">tags for project (separated by commas)</small>
             </fieldset>
-            {% if config.get('PRIVATE_PROJECTS', False) %}
+            {% if config.get('PRIVATE_PROJECTS', False) and repo.private %}
                 <fieldset class="form-group">
                     <label class="c-input c-checkbox">Private</lable>
                     <input type="checkbox" value="private" name="private" {%
diff --git a/pagure/ui/repo.py b/pagure/ui/repo.py
index 5a2c3c7..edd6237 100644
--- a/pagure/ui/repo.py
+++ b/pagure/ui/repo.py
@@ -1145,7 +1145,8 @@ def update_project(repo, username=None, namespace=None):
             repo.description = form.description.data
             repo.avatar_email = form.avatar_email.data.strip()
             repo.url = form.url.data.strip()
-            repo.private = form.private.data
+            if repo.private:
+                repo.private = form.private.data
             pagure.lib.update_tags(
                 SESSION, repo,
                 tags=[t.strip() for t in form.tags.data.split(',')],

From 4e8039d03cd7eb31e82c407e6329a2732d68baf1 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 4/13] Fix up Namespace private project


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/ui/app.py b/pagure/ui/app.py
index 9bce789..9e15d97 100644
--- a/pagure/ui/app.py
+++ b/pagure/ui/app.py
@@ -452,7 +452,7 @@ def new_project():
             private = form.private.data
         # Though it's not need for new_project() it fixes the redirect after
         if private:
-            namespace=flask.g.fas_user.username
+            namespace = flask.g.fas_user.username
 
         try:
             pagure.lib.new_project(

From d596a927d7ed65c3833c1ac8c840e3b04d754942 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 5/13] Make the get_csrf method be in the Modeltests class so all can inherit it


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/tests/__init__.py b/tests/__init__.py
index e45f43c..f43b640 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -202,6 +202,14 @@ class Modeltests(unittest.TestCase):
                 db_name = DB_PATH.rsplit('/', 1)[1]
                 requests.get('%s/clean/%s' % (FAITOUT_URL, db_name))
 
+    def get_csrf(self, url='/new'):
+        """Retrieve a CSRF token from given URL."""
+        output = self.app.get(url)
+        self.assertEqual(output.status_code, 200)
+
+        return output.data.split(
+            'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+
 
 class FakeGroup(object):    # pylint: disable=too-few-public-methods
     """ Fake object used to make the FakeUser object closer to the
diff --git a/tests/test_pagure_flask_ui_quick_reply.py b/tests/test_pagure_flask_ui_quick_reply.py
index 3df52b4..8dec2be 100644
--- a/tests/test_pagure_flask_ui_quick_reply.py
+++ b/tests/test_pagure_flask_ui_quick_reply.py
@@ -80,14 +80,6 @@ class PagureFlaskQuickReplytest(tests.Modeltests):
         self.repo.quick_replies = [self.r1, self.r2]
         self.session.add(self.repo)
 
-    def get_csrf(self, url='/test/settings'):
-        """Retrieve a CSRF token from given URL."""
-        output = self.app.get(url)
-        self.assertEqual(output.status_code, 200)
-
-        return output.data.split(
-            'name="csrf_token" type="hidden" value="')[1].split('">')[0]
-
     def assertRedirectToSettings(self, output, project='test', notice=None):
         """
         Check that user was redirected to settings page of a given project

From e153ce4c6bd9e79b5a7f9b4ce99e2639b1fd5934 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 6/13] Set the false_values for the private field in the html form


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/forms.py b/pagure/forms.py
index 7401501..6d84d45 100644
--- a/pagure/forms.py
+++ b/pagure/forms.py
@@ -132,7 +132,8 @@ class ProjectFormSimplified(PagureForm):
     )
     private = wtforms.BooleanField(
         'Private',
-        [wtforms.validators.Optional()]
+        [wtforms.validators.Optional()],
+        false_values=('false', '', False, 'False', 0, '0'),
     )
 
 

From 52565d53049892191d86d74cdd81b59520131514 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 7/13] Add unit-tests checking that we cannot do public -> private


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/tests/test_pagure_flask_api_ui_private_repo.py b/tests/test_pagure_flask_api_ui_private_repo.py
index 61cd14d..22ecc17 100644
--- a/tests/test_pagure_flask_api_ui_private_repo.py
+++ b/tests/test_pagure_flask_api_ui_private_repo.py
@@ -560,6 +560,7 @@ class PagurePrivateRepotest(tests.Modeltests):
     @patch('pagure.ui.repo.admin_session_timedout')
     def test_private_settings_ui(self, ast):
         """ Test UI for private repo"""
+        ast.return_value = False
 
         # Add private repo
         item = pagure.lib.model.Project(
@@ -584,27 +585,137 @@ class PagurePrivateRepotest(tests.Modeltests):
             tests.create_projects(self.session)
             tests.create_projects_git(pagure.APP.config.get('GIT_FOLDER'))
 
-            ast.return_value = False
-            output = self.app.post('/test/settings')
+            output = self.app.get('/test/settings')
 
             # Check for a public repo
             self.assertEqual(output.status_code, 200)
-            self.assertIn(
-                '<input type="checkbox" value="private" name="private"', output.get_data(as_text=True))
+            self.assertNotIn(
+                '<input type="checkbox" value="private" name="private"',
+                output.get_data(as_text=True))
 
-            ast.return_value = False
-            output = self.app.post('/test4/settings')
+            output = self.app.get('/test4/settings')
 
             # Check for private repo
             self.assertEqual(output.status_code, 200)
             self.assertIn(
-                '<input type="checkbox" value="private" name="private" checked=""/>', output.get_data(as_text=True))
+                '<input type="checkbox" value="private" name="private" checked=""/>',
+                output.get_data(as_text=True))
 
             # Check the new project form has 'private' checkbox
             output = self.app.get('/new')
             self.assertEqual(output.status_code, 200)
             self.assertIn(
-                '<input id="private" name="private" type="checkbox" value="y">', output.get_data(as_text=True))
+                '<input id="private" name="private" type="checkbox" value="y">',
+                output.get_data(as_text=True))
+
+    @patch('pagure.ui.repo.admin_session_timedout')
+    def test_private_settings_ui_update_privacy_false(self, ast):
+        """ Test UI for private repo"""
+        ast.return_value = False
+
+        # Add private repo
+        item = pagure.lib.model.Project(
+            user_id=1,  # pingou
+            name='test4',
+            description='test project description',
+            hook_token='aaabbbeeeceee',
+            private=True,
+        )
+        self.session.add(item)
+        self.session.commit()
+
+        # Add a git repo
+        repo_path = os.path.join(
+            pagure.APP.config.get('GIT_FOLDER'), 'test4.git')
+        pygit2.init_repository(repo_path)
+
+        user = tests.FakeUser(username='pingou')
+        with tests.user_set(pagure.APP, user):
+
+            # Check for private repo
+            output = self.app.get('/test4/settings')
+            self.assertEqual(output.status_code, 200)
+            self.assertIn(
+                '<input type="checkbox" value="private" name="private" checked=""/>',
+                output.get_data(as_text=True))
+
+            repo = pagure.lib._get_project(self.session, 'test4')
+            self.assertTrue(repo.private)
+
+            # Make the project public
+            data = {
+                'description': 'test project description',
+                'private': False,
+                'csrf_token': self.get_csrf(),
+            }
+            output = self.app.post(
+                '/test4/update', data=data, follow_redirects=True)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn(
+                '</button>\n'\
+                '                      Project updated',
+                output.get_data(as_text=True))
+            self.assertNotIn(
+                '<input type="checkbox" value="private" name="private" checked=""/>',
+                output.get_data(as_text=True))
+
+            repo = pagure.lib._get_project(self.session, 'test4')
+            self.assertFalse(repo.private)
+
+    @patch('pagure.ui.repo.admin_session_timedout')
+    def test_private_settings_ui_update_privacy_true(self, ast):
+        """ Test UI for private repo"""
+        ast.return_value = False
+
+        # Add private repo
+        item = pagure.lib.model.Project(
+            user_id=1,  # pingou
+            name='test4',
+            description='test project description',
+            hook_token='aaabbbeeeceee',
+            private=False,
+        )
+        self.session.add(item)
+        self.session.commit()
+
+        # Add a git repo
+        repo_path = os.path.join(
+            pagure.APP.config.get('GIT_FOLDER'), 'test4.git')
+        pygit2.init_repository(repo_path)
+
+        user = tests.FakeUser(username='pingou')
+        with tests.user_set(pagure.APP, user):
+
+            # Check for public repo
+            output = self.app.get('/test4/settings')
+            self.assertEqual(output.status_code, 200)
+            self.assertNotIn(
+                '<input type="checkbox" value="private" name="private" checked=""/>',
+                output.get_data(as_text=True))
+
+            repo = pagure.lib._get_project(self.session, 'test4')
+            self.assertFalse(repo.private)
+
+            # Make the project private
+            data = {
+                'description': 'test project description',
+                'private': True,
+                'csrf_token': self.get_csrf(),
+            }
+            output = self.app.post(
+                '/test4/update', data=data, follow_redirects=True)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn(
+                '</button>\n'\
+                '                      Project updated',
+                output.get_data(as_text=True))
+            self.assertNotIn(
+                '<input type="checkbox" value="private" name="private" checked=""/>',
+                output.get_data(as_text=True))
+
+            # No change since we can't do public -> private
+            repo = pagure.lib._get_project(self.session, 'test4')
+            self.assertFalse(repo.private)
 
     @patch('pagure.lib.notify.send_email')
     def test_private_pr(self, send_email):

From f1cd9335d032f3c984832d98b84d8562c74eca99 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 8/13] Add unit-tests checking private projects created in the UI are namespaced


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/tests/test_pagure_flask_ui_app.py b/tests/test_pagure_flask_ui_app.py
index 77522e0..93a9f5f 100644
--- a/tests/test_pagure_flask_ui_app.py
+++ b/tests/test_pagure_flask_ui_app.py
@@ -296,6 +296,87 @@ class PagureFlaskApptests(tests.Modeltests):
         self.assertTrue(os.path.exists(
             os.path.join(self.path, 'requests', 'project-1.git')))
 
+    @patch.dict('pagure.APP.config', {'PRIVATE_PROJECTS': True})
+    def test_new_project_private(self):
+        """ Test the new_project endpoint for a private project. """
+        # Before
+        projects = pagure.lib.search_projects(self.session)
+        self.assertEqual(len(projects), 0)
+        self.assertFalse(os.path.exists(
+            os.path.join(self.path, 'foo', 'project#1.git')))
+        self.assertFalse(os.path.exists(
+            os.path.join(self.path, 'tickets', 'foo', 'project#1.git')))
+        self.assertFalse(os.path.exists(
+            os.path.join(self.path, 'docs', 'foo', 'project#1.git')))
+        self.assertFalse(os.path.exists(
+            os.path.join(self.path, 'requests', 'foo', 'project#1.git')))
+
+        user = tests.FakeUser()
+        with tests.user_set(pagure.APP, user):
+            output = self.app.get('/new/')
+            self.assertEqual(output.status_code, 200)
+            self.assertIn(
+                u'<strong>Create new Project</strong>', output.data)
+
+            csrf_token = output.data.split(
+                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+
+            data = {
+                'description': 'Project #1',
+                'private': True,
+            }
+
+            output = self.app.post('/new/', data=data)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn(
+                u'<strong>Create new Project</strong>', output.data)
+            self.assertIn(
+                u'<small>\n            This field is required.&nbsp;\n'
+                '          </small>', output.data)
+
+            data['name'] = 'project-1'
+            output = self.app.post('/new/', data=data)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<strong>Create new Project</strong>', output.data)
+            self.assertNotIn(
+                u'<small>\n            This field is required.&nbsp;\n'
+                '          </small>', output.data)
+
+            data['csrf_token'] =  csrf_token
+            output = self.app.post('/new/', data=data)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<strong>Create new Project</strong>', output.data)
+            self.assertIn(
+                u'</button>\n                      No user '
+                '&#34;username&#34; found\n                    </div>',
+                output.data)
+
+        user.username = 'foo'
+        with tests.user_set(pagure.APP, user):
+            data['csrf_token'] =  csrf_token
+            output = self.app.post('/new/', data=data, follow_redirects=True)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn(
+                u'<div class="projectinfo m-t-1 m-b-1">\nProject #1        </div>',
+                output.data)
+            self.assertIn(u'<p>This repo is brand new!</p>', output.data)
+            self.assertIn(
+                u'<title>Overview - foo/project-1 - Pagure</title>', output.data)
+
+        # After
+        projects = pagure.lib.search_projects(self.session)
+        self.assertEqual(len(projects), 0)
+        projects = pagure.lib.search_projects(self.session, private=True)
+        self.assertEqual(len(projects), 1)
+        self.assertTrue(os.path.exists(
+            os.path.join(self.path, 'foo', 'project-1.git')))
+        self.assertTrue(os.path.exists(
+            os.path.join(self.path, 'tickets', 'foo', 'project-1.git')))
+        self.assertTrue(os.path.exists(
+            os.path.join(self.path, 'docs', 'foo', 'project-1.git')))
+        self.assertTrue(os.path.exists(
+            os.path.join(self.path, 'requests', 'foo', 'project-1.git')))
+
     def test_non_ascii_new_project(self):
         """ Test the new_project endpoint with a non-ascii project. """
         # Before

From 3a7944941909d9eea5c37e09554f35120f9a8ed4 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 9/13] Make private projects created via the API are namespaced


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/api/project.py b/pagure/api/project.py
index ae37788..9c8fef0 100644
--- a/pagure/api/project.py
+++ b/pagure/api/project.py
@@ -361,6 +361,14 @@ def api_new_project():
     |                  |         |              |   added to the project on |
     |                  |         |              |   creation.               |
     +------------------+---------+--------------+---------------------------+
+    | ``private``      | boolean | Optional     | | A boolean to specify if |
+    |                  |         |              |   the project to create   |
+    |                  |         |              |   is private.             |
+    |                  |         |              |   Note: not all pagure    |
+    |                  |         |              |   instance support private|
+    |                  |         |              |   projects, confirm this  |
+    |                  |         |              |   with your administrators|
+    +------------------+---------+--------------+---------------------------+
 
     Sample response
     ^^^^^^^^^^^^^^^
@@ -396,12 +404,17 @@ def api_new_project():
         if namespace:
             namespace = namespace.strip()
 
+        private = False
+        if pagure.APP.config.get('PRIVATE_PROJECTS', False):
+            private = form.private.data
+
         try:
             message = pagure.lib.new_project(
                 SESSION,
                 name=name,
                 namespace=namespace,
                 description=description,
+                private=private,
                 url=url,
                 avatar_email=avatar_email,
                 user=flask.g.fas_user.username,
diff --git a/tests/test_pagure_flask_api_project.py b/tests/test_pagure_flask_api_project.py
index 70016f6..46e5b40 100644
--- a/tests/test_pagure_flask_api_project.py
+++ b/tests/test_pagure_flask_api_project.py
@@ -622,6 +622,36 @@ class PagureFlaskApiProjecttests(tests.Modeltests):
             {'message': 'Project "test_42" created'}
         )
 
+    @patch.dict('pagure.APP.config', {'PRIVATE_PROJECTS': True})
+    @patch('pagure.lib.git.generate_gitolite_acls')
+    def test_api_new_project_private(self, p_gga):
+        """ Test the api_new_project method of the flask api to create
+        a private project. """
+        p_gga.return_value = True
+
+        tests.create_projects(self.session)
+        tests.create_projects_git(os.path.join(self.path, 'tickets'))
+        tests.create_tokens(self.session)
+        tests.create_tokens_acl(self.session)
+
+        headers = {'Authorization': 'token aaabbbcccddd'}
+
+        data = {
+            'name': 'test',
+            'description': 'Just a small test project',
+            'private': True,
+        }
+
+        # Valid request
+        output = self.app.post(
+            '/api/0/new/', data=data, headers=headers)
+        self.assertEqual(output.status_code, 200)
+        data = json.loads(output.data)
+        self.assertDictEqual(
+            data,
+            {'message': 'Project "pingou/test" created'}
+        )
+
     @patch('pagure.lib.git.generate_gitolite_acls')
     def test_api_new_project_user_token(self, p_gga):
         """ Test the api_new_project method of the flask api. """

From a4a7abcc88154fa20c2b89bcbd976467f747b7f3 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 10/13] Consolidate the list of all false values for the form in one place


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/forms.py b/pagure/forms.py
index 6d84d45..5281c05 100644
--- a/pagure/forms.py
+++ b/pagure/forms.py
@@ -32,6 +32,7 @@ import pagure.lib
 STRICT_REGEX = '^[a-zA-Z0-9-_]+$'
 TAGS_REGEX = '^[a-zA-Z0-9-_, .]+$'
 PROJECT_NAME_REGEX = '^[a-zA-z0-9_][a-zA-Z0-9-_]*$'
+FALSE_VALUES = ('false', '', False, 'False', 0, '0')
 
 
 class PagureForm(FlaskForm):
@@ -133,7 +134,7 @@ class ProjectFormSimplified(PagureForm):
     private = wtforms.BooleanField(
         'Private',
         [wtforms.validators.Optional()],
-        false_values=('false', '', False, 'False', 0, '0'),
+        false_values=FALSE_VALUES,
     )
 
 
@@ -149,7 +150,7 @@ class ProjectForm(ProjectFormSimplified):
     create_readme = wtforms.BooleanField(
         'Create README',
         [wtforms.validators.optional()],
-        false_values=('false', '', False, 'False', 0, '0'),
+        false_values=FALSE_VALUES,
     )
     namespace = wtforms.SelectField(
         'Project Namespace',
@@ -185,7 +186,7 @@ class IssueFormSimplied(PagureForm):
     private = wtforms.BooleanField(
         'Private',
         [wtforms.validators.optional()],
-        false_values=('false', '', False, 'False', 0, '0'),
+        false_values=FALSE_VALUES,
     )
     milestone = wtforms.TextField(
         'Milestone',
@@ -379,7 +380,7 @@ class UpdateIssueForm(PagureForm):
     private = wtforms.BooleanField(
         'Private',
         [wtforms.validators.optional()],
-        false_values=('false', '', False, 'False', 0, '0'),
+        false_values=FALSE_VALUES,
     )
     close_status = wtforms.SelectField(
         'Closed as',
@@ -465,7 +466,7 @@ class AddDeployKeyForm(PagureForm):
     pushaccess = wtforms.BooleanField(
         'Push access',
         [wtforms.validators.optional()],
-        false_values=('false', '', False, 'False', 0, '0'),
+        false_values=FALSE_VALUES,
     )
 
 
@@ -705,5 +706,5 @@ class SubscribtionForm(PagureForm):
     status = wtforms.BooleanField(
         'Subscription status',
         [wtforms.validators.optional()],
-        false_values=('false', '', False, 'False', 0, '0'),
+        false_values=FALSE_VALUES,
     )

From bdcc9e54644dc6c68ba11f2dd4af7b8fb09deff8 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 11/13] No need to conditional the checked in the checkbox


Since that checkbox is only shown when checked

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/templates/settings.html b/pagure/templates/settings.html
index 7b7d0de..ff26915 100644
--- a/pagure/templates/settings.html
+++ b/pagure/templates/settings.html
@@ -44,8 +44,7 @@
             {% if config.get('PRIVATE_PROJECTS', False) and repo.private %}
                 <fieldset class="form-group">
                     <label class="c-input c-checkbox">Private</lable>
-                    <input type="checkbox" value="private" name="private" {%
-                        if repo.private -%}checked=""{%- endif -%}/>
+                    <input type="checkbox" value="private" name="private" checked="" />
                     <span class="c-indicator"></span>
                 </fieldset>
             {% endif %}
diff --git a/tests/test_pagure_flask_api_ui_private_repo.py b/tests/test_pagure_flask_api_ui_private_repo.py
index 22ecc17..16e02ab 100644
--- a/tests/test_pagure_flask_api_ui_private_repo.py
+++ b/tests/test_pagure_flask_api_ui_private_repo.py
@@ -598,7 +598,7 @@ class PagurePrivateRepotest(tests.Modeltests):
             # Check for private repo
             self.assertEqual(output.status_code, 200)
             self.assertIn(
-                '<input type="checkbox" value="private" name="private" checked=""/>',
+                '<input type="checkbox" value="private" name="private" checked="" />',
                 output.get_data(as_text=True))
 
             # Check the new project form has 'private' checkbox
@@ -636,7 +636,7 @@ class PagurePrivateRepotest(tests.Modeltests):
             output = self.app.get('/test4/settings')
             self.assertEqual(output.status_code, 200)
             self.assertIn(
-                '<input type="checkbox" value="private" name="private" checked=""/>',
+                '<input type="checkbox" value="private" name="private" checked="" />',
                 output.get_data(as_text=True))
 
             repo = pagure.lib._get_project(self.session, 'test4')
@@ -656,7 +656,7 @@ class PagurePrivateRepotest(tests.Modeltests):
                 '                      Project updated',
                 output.get_data(as_text=True))
             self.assertNotIn(
-                '<input type="checkbox" value="private" name="private" checked=""/>',
+                '<input type="checkbox" value="private" name="private" checked="" />',
                 output.get_data(as_text=True))
 
             repo = pagure.lib._get_project(self.session, 'test4')

From 27f83987ae7868d25ba35a3b4bfe7a0a8bbab3e4 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 12/13] Fix typo/grammar in the comment


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/ui/app.py b/pagure/ui/app.py
index 9e15d97..55d6f05 100644
--- a/pagure/ui/app.py
+++ b/pagure/ui/app.py
@@ -450,7 +450,8 @@ def new_project():
         private = False
         if pagure.APP.config.get('PRIVATE_PROJECTS', False):
             private = form.private.data
-        # Though it's not need for new_project() it fixes the redirect after
+        # Although it's not needed for the new_project function, it fixes
+        # the redirect afterward
         if private:
             namespace = flask.g.fas_user.username
 

From aeff2b3dae29fc53b48a1b4cac900557a8732924 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Apr 30 2017 15:27:34 +0000
Subject: [PATCH 13/13] Add a custom validator to set the namespace when the project to create is private


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/forms.py b/pagure/forms.py
index 5281c05..2f35243 100644
--- a/pagure/forms.py
+++ b/pagure/forms.py
@@ -74,6 +74,13 @@ class MultipleEmail(wtforms.validators.Email):
                 raise wtforms.validators.ValidationError(message)
 
 
+def user_namespace_if_private(form, field):
+    ''' Check if the data in the field is the same as in the password field.
+    '''
+    if form.private.data:
+        field.data = flask.g.fas_user.username
+
+
 def file_virus_validator(form, field):
     ''' Checks for virus in the file from flask request object,
     raises wtf.ValidationError if virus is found else None. '''
@@ -154,7 +161,7 @@ class ProjectForm(ProjectFormSimplified):
     )
     namespace = wtforms.SelectField(
         'Project Namespace',
-        [wtforms.validators.optional()],
+        [user_namespace_if_private, wtforms.validators.optional()],
         choices=[],
         coerce=convert_value
     )
diff --git a/pagure/ui/app.py b/pagure/ui/app.py
index 55d6f05..ed8e78c 100644
--- a/pagure/ui/app.py
+++ b/pagure/ui/app.py
@@ -444,16 +444,12 @@ def new_project():
         url = form.url.data
         avatar_email = form.avatar_email.data
         create_readme = form.create_readme.data
-        namespace = form.namespace.data
-        if namespace:
-            namespace = namespace.strip()
         private = False
         if pagure.APP.config.get('PRIVATE_PROJECTS', False):
             private = form.private.data
-        # Although it's not needed for the new_project function, it fixes
-        # the redirect afterward
-        if private:
-            namespace = flask.g.fas_user.username
+        namespace = form.namespace.data
+        if namespace:
+            namespace = namespace.strip()
 
         try:
             pagure.lib.new_project(