From 808ce8b78dc8930ff4e29389a3e4c5feee3ed4cd Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Mar 22 2019 15:50:39 +0000
Subject: Do not link on the "Star" button if the user is not authenticated


Otherwise, people who are not authenticated are able to click on the
button. This will redirect the user to the login page, then back into
the star project endpoint, but this endpoint only accepts POST requests
while redirect can only be done via GET requests.
So the user ends up with a page showing a 405 (method not allowed) error.
By dropping the link for not-authenticated users, we solve this issue.

Fixes https://pagure.io/pagure/issue/4372

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/templates/repo_info.html b/pagure/templates/repo_info.html
index 39724f4..b0ab2ce 100644
--- a/pagure/templates/repo_info.html
+++ b/pagure/templates/repo_info.html
@@ -85,11 +85,10 @@
               {%- if repo.url %} &nbsp;| &nbsp;<a class="inline" href="{{ repo.url }}">{{ repo.url }}</a>{% endif %}
             </div>
             <div class="btn-group">
-                {% if not g.repo_starred %}
-                    <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
+                {% if g.authenticated and not g.repo_starred %}
+                  <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
                     onclick="$('#star_project').submit();">
-                      <i class="fa fa-star-o fa-fw"></i>Star
-                      <form method="POST" name="star_project" id="star_project"
+                    <form method="POST" name="star_project" id="star_project"
                       action="{{ url_for(
                       'ui_ns.star_project',
                       repo=repo.name,
@@ -98,14 +97,15 @@
                       star=1)}}">
                       {{ g.forkbuttonform.csrf_token }}
                       </form>
-                    </a>
-                      <a href="{{url_for(
-                                  'ui_ns.view_stargazers',
-                                  repo=repo.name,
-                                  username=repo.user.user if repo.is_fork else None,
-                                  namespace=repo.namespace,
-                      )}}" class="btn btn-sm btn-primary font-weight-bold">{{ repo.stargazers|length }}</a>
-                {% else %}
+                    <i class="fa fa-star-o fa-fw"></i>Star
+                  </a>
+                  <a href="{{url_for(
+                                'ui_ns.view_stargazers',
+                                repo=repo.name,
+                                username=repo.user.user if repo.is_fork else None,
+                                namespace=repo.namespace,
+                    )}}" class="btn btn-sm btn-primary font-weight-bold">{{ repo.stargazers|length }}</a>
+                {% elif g.authenticated and g.repo_starred %}
                   <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
                     onclick="$('#unstar_project').submit();">
                     <form method="POST" name="unstar_project" id="unstar_project"
@@ -117,15 +117,28 @@
                       star=0)}}">
                       {{ g.forkbuttonform.csrf_token }}
                     </form>
-                      <span class="fa fa-star text-warning"></span> Unstar</a>
-                      <a href="{{url_for(
-                                  'ui_ns.view_stargazers',
-                                  repo=repo.name,
-                                  username=repo.user.user if repo.is_fork else None,
-                                  namespace=repo.namespace,
-                      )}}" class="btn btn-sm btn-primary font-weight-bold">{{repo.stargazers|length}}</a>
+                    <span class="fa fa-star text-warning"></span> Unstar
+                  </a>
+                  <a href="{{url_for(
+                                'ui_ns.view_stargazers',
+                                repo=repo.name,
+                                username=repo.user.user if repo.is_fork else None,
+                                namespace=repo.namespace,
+                    )}}" class="btn btn-sm btn-primary font-weight-bold">{{repo.stargazers|length}}</a>
+                {% else %}
+                  <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
+                     title="Log in to Star the project">
+                    <span class="fa fa-star text-warning"></span> Star
+                  </a>
+                  <a href="{{url_for(
+                                'ui_ns.view_stargazers',
+                                repo=repo.name,
+                                username=repo.user.user if repo.is_fork else None,
+                                namespace=repo.namespace,
+                    )}}" class="btn btn-sm btn-primary font-weight-bold">{{repo.stargazers|length}}
+                  </a>
                 {% endif %}
-                </div>
+            </div>
 
                 <div class="btn-group">
                     <a href="#" title="{{ watch_button_title }}"
diff --git a/pagure/themes/srcfpo/templates/repo_info.html b/pagure/themes/srcfpo/templates/repo_info.html
index 571b261..7b541de 100644
--- a/pagure/themes/srcfpo/templates/repo_info.html
+++ b/pagure/themes/srcfpo/templates/repo_info.html
@@ -119,27 +119,27 @@
               <div class="col">
 
                 <div class="btn-group">
-                  {% if not g.repo_starred %}
-                      <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
-                      onclick="$('#star_project').submit();">
-                        <i class="fa fa-star-o fa-fw"></i>Star
-                        <form method="POST" name="star_project" id="star_project"
-                        action="{{ url_for(
-                        'ui_ns.star_project',
-                        repo=repo.name,
-                        username=username,
-                        namespace=repo.namespace,
-                        star=1)}}">
-                        {{ g.forkbuttonform.csrf_token }}
-                        </form>
-                      </a>
-                        <a href="{{url_for(
-                                    'ui_ns.view_stargazers',
-                                    repo=repo.name,
-                                    username=repo.user.user if repo.is_fork else None,
-                                    namespace=repo.namespace,
-                        )}}" class="btn btn-sm btn-primary font-weight-bold">{{ repo.stargazers|length }}</a>
-                  {% else %}
+                  {% if g.authenticated and not g.repo_starred %}
+                    <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
+                    onclick="$('#star_project').submit();">
+                      <i class="fa fa-star-o fa-fw"></i>Star
+                      <form method="POST" name="star_project" id="star_project"
+                      action="{{ url_for(
+                      'ui_ns.star_project',
+                      repo=repo.name,
+                      username=username,
+                      namespace=repo.namespace,
+                      star=1)}}">
+                      {{ g.forkbuttonform.csrf_token }}
+                      </form>
+                    </a>
+                      <a href="{{url_for(
+                                  'ui_ns.view_stargazers',
+                                  repo=repo.name,
+                                  username=repo.user.user if repo.is_fork else None,
+                                  namespace=repo.namespace,
+                      )}}" class="btn btn-sm btn-primary font-weight-bold">{{ repo.stargazers|length }}</a>
+                  {% elif g.authenticated and g.repo_starred %}
                     <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
                       onclick="$('#unstar_project').submit();">
                       <form method="POST" name="unstar_project" id="unstar_project"
@@ -158,6 +158,18 @@
                                     username=repo.user.user if repo.is_fork else None,
                                     namespace=repo.namespace,
                         )}}" class="btn btn-sm btn-primary font-weight-bold">{{repo.stargazers|length}}</a>
+                  {% else %}
+                    <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
+                       title="Log in to Star the project">
+                      <span class="fa fa-star text-warning"></span> Star
+                    </a>
+                    <a href="{{url_for(
+                                  'ui_ns.view_stargazers',
+                                  repo=repo.name,
+                                  username=repo.user.user if repo.is_fork else None,
+                                  namespace=repo.namespace,
+                      )}}" class="btn btn-sm btn-primary font-weight-bold">{{repo.stargazers|length}}
+                    </a>
                   {% endif %}
                 </div>