From ae92283730f6f242cb0e71dedd7a44b58ccaf566 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Feb 09 2018 09:38:58 +0000
Subject: [PATCH 1/2] Fix editing and deleting comments added by the EV server to PRs


Basically, we had the project url hard-coded in the html instead of have
it automatically generated from the content passed on by the EV server
so editing a comment added by the EV server was only ever going to work
on a one project.

In addition, the form and csrf token were missing to allow the delete
button to work.
Both form and csrf token are now present on the html page, thus allowing
to right away delete a generic comment that was added by the EV server.

Fixes https://pagure.io/pagure/issue/2958

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/lib/__init__.py b/pagure/lib/__init__.py
index 29d1841..1bfda0a 100644
--- a/pagure/lib/__init__.py
+++ b/pagure/lib/__init__.py
@@ -1238,6 +1238,7 @@ def add_pull_request_comment(session, request, commit, tree_id, filename,
             'comment_added': comment_text,
             'comment_user': pr_comment.user.user,
             'comment_id': pr_comment.id,
+            'project': request.project.fullname,
             'avatar_url': avatar_url_from_email(
                 pr_comment.user.default_email, size=16),
             'comment_date': pr_comment.date_created.strftime(
diff --git a/pagure/static/request_ev.js b/pagure/static/request_ev.js
index 66d36ba..58219c5 100644
--- a/pagure/static/request_ev.js
+++ b/pagure/static/request_ev.js
@@ -2,7 +2,7 @@ add_comment = function(data, username) {
   console.log('Adding comment ' + data.comment_added);
   var field = $('#comments');
   var edit_btn = '<a class="btn btn-secondary btn-sm edit_btn" \
-        href="/test/pull-request/' + data.request_id + '/comment/' + data.comment_id + '/edit" \
+        href="/' + data.project + '/pull-request/' + data.request_id + '/comment/' + data.comment_id + '/edit" \
         data-comment="' + data.comment_id + '" \
         data-objid="' + data.request_id + '"> \
         <span class="oi" data-glyph="pencil"></span> \
@@ -61,41 +61,46 @@ add_comment = function(data, username) {
         </div></div></div> \
         </td></tr>';
   } else {
-  var _data = '<div class="card clearfix"> \
-    <div id="comment-' + data.comment_id + '" class="card-header"> \
-    <img class="avatar circle" src="' + data.avatar_url + '"/> \
-    <a href="/user/' + data.comment_user + '"> ' + data.comment_user + '\
-      </a> \
-      <a class="headerlink pull-xs-right" title="Permalink to this headline" \
-        href="#comment-' + data.comment_id + '"> \
-        <span title="">seconds ago</span> \
-       </a>\
-    </div>\
-    <div class="card-block">\
-      <section class="issue_comment"> \
-        <div class="comment_body"> \
-          <span class="edit_date" title=""> \
-          </span>'
-        + emojione.toImage(data.comment_added) + '\
-        </div> \
-      </section> \
-      <div class="issue_actions m-t-2"> \
-        <div class="issue_action icon pull-xs-right p-b-1"> \
-          <div class="btn-group" role="group" aria-label="Basic example"> \
-            <a class="reply btn btn-secondary btn-sm" data-toggle="tooltip" title="Reply to this comment - lose formatting"> \
-              <span class="oi" data-glyph="share-boxed"></span> \
-            </a>';
-    if ( data.comment_user == username) {
-        _data += edit_btn +
-            '<button class="btn btn-secondary btn-sm" type="submit" name="drop_comment" value="' + data.comment_id + '" \
-                onclick="return confirm(\'Do you really want to remove this comment?\');" \
-                title="Remove comment"> \
-                <span class="oi" data-glyph="trash"></span> \
-            </button>';
-    }
-    _data += '</div> \
-        </div> \
-    </div>';
+    var _csrf = $('#csrf_token').clone();
+    var _data = '<form action="/' + data.project + '/pull-request/' +  data.request_id
+        + '/comment/drop" method="post" onsubmit="return try_async_comment(this, null)"> \
+        <div class="card clearfix"> \
+            <div id="comment-' + data.comment_id + '" class="card-header"> \
+            <img class="avatar circle" src="' + data.avatar_url + '"/> \
+            <a href="/user/' + data.comment_user + '"> ' + data.comment_user + '\
+              </a> \
+              <a class="headerlink pull-xs-right" title="Permalink to this headline" \
+                href="#comment-' + data.comment_id + '"> \
+                <span title="">seconds ago</span> \
+               </a>\
+            </div>\
+            <div class="card-block">\
+              <section class="issue_comment"> \
+                <div class="comment_body"> \
+                  <span class="edit_date" title=""> \
+                  </span>'
+                + emojione.toImage(data.comment_added) + '\
+                </div> \
+              </section> \
+              <div class="issue_actions m-t-2"> \
+                <div class="issue_action icon pull-xs-right p-b-1"> \
+                  <div class="btn-group" role="group" aria-label="Basic example"> \
+                    <a class="reply btn btn-secondary btn-sm" data-toggle="tooltip" title="Reply to this comment - lose formatting"> \
+                      <span class="oi" data-glyph="share-boxed"></span> \
+                    </a>';
+            if ( data.comment_user == username) {
+                _data += edit_btn +
+                    '<button class="btn btn-secondary btn-sm" type="submit" name="drop_comment" value="' + data.comment_id + '" \
+                        onclick="return confirm(\'Do you really want to remove this comment?\');" \
+                        title="Remove comment"> \
+                        <span class="oi" data-glyph="trash"></span> \
+                    </button>';
+            }
+            _data += '</div> \
+                </div> \
+            </div> \
+        <input id="csrf_token" name="csrf_token" value="' + _csrf.val() + '" type="hidden"> \
+        </form>';
   }
 
   if (inline){

From a76b0fc98716b5085694a597d48238c95fa95e2d Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Feb 09 2018 09:38:58 +0000
Subject: [PATCH 2/2] Move back to use then authenticated method


Instead of relying on the present of flask.g.authenticated.

The perf gain isn't that important but this change is having consequences
in a number of places in the code to the point that it is as simple to
revert this change.

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/utils.py b/pagure/utils.py
index 1485452..f58057a 100644
--- a/pagure/utils.py
+++ b/pagure/utils.py
@@ -49,7 +49,7 @@ def is_safe_url(target):  # pragma: no cover
 
 def is_admin():
     """ Return whether the user is admin for this application or not. """
-    if not flask.g.authenticated:
+    if not authenticated():
         return False
 
     user = flask.g.fas_user