From e88504bcc0f55830a3c0925b3175009d46e86e42 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Feb 25 2019 16:16:50 +0000 Subject: Fix delete permission detection for PRs against the same repo If the repository the PR is against is the same as the PR is from, "request.project_from" is None, and we should check "request.project" to see whether the person has permission to delete branches. This was causing "repo_obj" in is_repo_committer to be None. The reason this wasn't encountered by any admins is because is_repo_committer returns True with "is_admin()" before it even gets to using repo_obj. Signed-off-by: Patrick Uiterwijk --- diff --git a/pagure/ui/fork.py b/pagure/ui/fork.py index e67979f..4a8f2e1 100644 --- a/pagure/ui/fork.py +++ b/pagure/ui/fork.py @@ -331,7 +331,9 @@ def request_pull(repo, requestid, username=None, namespace=None): can_delete_branch = ( pagure_config.get("ALLOW_DELETE_BRANCH", True) and not request.remote_git - and pagure.utils.is_repo_committer(request.project_from) + and pagure.utils.is_repo_committer( + request.project_from or request.project + ) ) return flask.render_template( "repo_pull_request.html", @@ -1134,7 +1136,9 @@ def merge_request_pull(repo, requestid, username=None, namespace=None): requestid=requestid, ) ) - if not pagure.utils.is_repo_committer(request.project_from): + if not pagure.utils.is_repo_committer( + request.project_from or request.project + ): flask.flash( "You do not have permissions to delete the branch in the " "source repo",