opendev/gerrit
Code Issues Proposed changes

Check canEditAssignee with PermissionBackend

Browse Source 
Change-Id: I373267a7272f35e972dde5c38cce6f753196350c
This commit is contained in:
Shawn Pearce
2017-02-18 15:46:21 -08:00
committed by David Pursehouse
parent 03c48e308c
commit 6b9563f3ce
5 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
gerrit-server/src/main/java/com/google/gerrit/server/api/changes/ChangeApiImpl.java
View File

@@ -494,7 +494,7 @@ class ChangeApiImpl implements ChangeApi {
public AccountInfo setAssignee(AssigneeInput input) throws RestApiException { public AccountInfo setAssignee(AssigneeInput input) throws RestApiException {
try { try {
return putAssignee.apply(change, input); return putAssignee.apply(change, input);
} catch (UpdateException | IOException | OrmException e) { } catch (UpdateException | IOException | OrmException | PermissionBackendException e) {
throw new RestApiException("Cannot set assignee", e); throw new RestApiException("Cannot set assignee", e);
} }
} }
@@ -523,7 +523,7 @@ class ChangeApiImpl implements ChangeApi {
try { try {
Response<AccountInfo> r = deleteAssignee.apply(change, null); Response<AccountInfo> r = deleteAssignee.apply(change, null);
return r.isNone() ? null : r.value(); return r.isNone() ? null : r.value();
} catch (UpdateException | OrmException e) { } catch (UpdateException | OrmException | PermissionBackendException e) {
throw new RestApiException("Cannot delete assignee", e); throw new RestApiException("Cannot delete assignee", e);
} }
} }

10
gerrit-server/src/main/java/com/google/gerrit/server/change/DeleteAssignee.java
View File

@@ -16,7 +16,6 @@ package com.google.gerrit.server.change;
import com.google.gerrit.common.TimeUtil; import com.google.gerrit.common.TimeUtil;
import com.google.gerrit.extensions.common.AccountInfo; import com.google.gerrit.extensions.common.AccountInfo;
import com.google.gerrit.extensions.restapi.AuthException;
import com.google.gerrit.extensions.restapi.Response; import com.google.gerrit.extensions.restapi.Response;
import com.google.gerrit.extensions.restapi.RestApiException; import com.google.gerrit.extensions.restapi.RestApiException;
import com.google.gerrit.extensions.restapi.RestModifyView; import com.google.gerrit.extensions.restapi.RestModifyView;
@@ -30,6 +29,8 @@ import com.google.gerrit.server.account.AccountLoader;
import com.google.gerrit.server.change.DeleteAssignee.Input; import com.google.gerrit.server.change.DeleteAssignee.Input;
import com.google.gerrit.server.extensions.events.AssigneeChanged; import com.google.gerrit.server.extensions.events.AssigneeChanged;
import com.google.gerrit.server.notedb.ChangeUpdate; import com.google.gerrit.server.notedb.ChangeUpdate;
import com.google.gerrit.server.permissions.ChangePermission;
import com.google.gerrit.server.permissions.PermissionBackendException;
import com.google.gerrit.server.update.BatchUpdate; import com.google.gerrit.server.update.BatchUpdate;
import com.google.gerrit.server.update.BatchUpdateOp; import com.google.gerrit.server.update.BatchUpdateOp;
import com.google.gerrit.server.update.ChangeContext; import com.google.gerrit.server.update.ChangeContext;
@@ -69,7 +70,9 @@ public class DeleteAssignee implements RestModifyView<ChangeResource, Input> {
@Override @Override
public Response<AccountInfo> apply(ChangeResource rsrc, Input input) public Response<AccountInfo> apply(ChangeResource rsrc, Input input)
throws RestApiException, UpdateException, OrmException { throws RestApiException, UpdateException, OrmException, PermissionBackendException {
rsrc.permissions().check(ChangePermission.EDIT_ASSIGNEE);
try (BatchUpdate bu = try (BatchUpdate bu =
batchUpdateFactory.create(db.get(), rsrc.getProject(), rsrc.getUser(), TimeUtil.nowTs())) { batchUpdateFactory.create(db.get(), rsrc.getProject(), rsrc.getUser(), TimeUtil.nowTs())) {
Op op = new Op(); Op op = new Op();
@@ -88,9 +91,6 @@ public class DeleteAssignee implements RestModifyView<ChangeResource, Input> {
@Override @Override
public boolean updateChange(ChangeContext ctx) throws RestApiException, OrmException { public boolean updateChange(ChangeContext ctx) throws RestApiException, OrmException {
if (!ctx.getControl().canEditAssignee()) {
throw new AuthException("Delete Assignee not permitted");
}
change = ctx.getChange(); change = ctx.getChange();
ChangeUpdate update = ctx.getUpdate(change.currentPatchSetId()); ChangeUpdate update = ctx.getUpdate(change.currentPatchSetId());
Account.Id currentAssigneeId = change.getAssignee(); Account.Id currentAssigneeId = change.getAssignee();

14
gerrit-server/src/main/java/com/google/gerrit/server/change/PutAssignee.java
View File

@@ -31,6 +31,8 @@ import com.google.gerrit.server.IdentifiedUser;
import com.google.gerrit.server.account.AccountLoader; import com.google.gerrit.server.account.AccountLoader;
import com.google.gerrit.server.account.AccountsCollection; import com.google.gerrit.server.account.AccountsCollection;
import com.google.gerrit.server.change.PostReviewers.Addition; import com.google.gerrit.server.change.PostReviewers.Addition;
import com.google.gerrit.server.permissions.ChangePermission;
import com.google.gerrit.server.permissions.PermissionBackendException;
import com.google.gerrit.server.update.BatchUpdate; import com.google.gerrit.server.update.BatchUpdate;
import com.google.gerrit.server.update.UpdateException; import com.google.gerrit.server.update.UpdateException;
import com.google.gwtorm.server.OrmException; import com.google.gwtorm.server.OrmException;
@@ -68,10 +70,10 @@ public class PutAssignee
@Override @Override
public AccountInfo apply(ChangeResource rsrc, AssigneeInput input) public AccountInfo apply(ChangeResource rsrc, AssigneeInput input)
throws RestApiException, UpdateException, OrmException, IOException { throws RestApiException, UpdateException, OrmException, IOException,
if (!rsrc.getControl().canEditAssignee()) { PermissionBackendException {
throw new AuthException("Changing Assignee not permitted"); rsrc.permissions().check(ChangePermission.EDIT_ASSIGNEE);
}
if (input.assignee == null || input.assignee.trim().isEmpty()) { if (input.assignee == null || input.assignee.trim().isEmpty()) {
throw new BadRequestException("missing assignee field"); throw new BadRequestException("missing assignee field");
} }
@@ -114,9 +116,9 @@ public class PutAssignee
} }
@Override @Override
public UiAction.Description getDescription(ChangeResource resource) { public UiAction.Description getDescription(ChangeResource rsrc) {
return new UiAction.Description() return new UiAction.Description()
.setLabel("Edit Assignee") .setLabel("Edit Assignee")
.setVisible(resource.getControl().canEditAssignee()); .setVisible(rsrc.permissions().testOrFalse(ChangePermission.EDIT_ASSIGNEE));
} }
} }

2
gerrit-server/src/main/java/com/google/gerrit/server/project/ChangeControl.java
View File

@@ -456,7 +456,7 @@ public class ChangeControl {
return false; return false;
} }
public boolean canEditAssignee() { private boolean canEditAssignee() {
return isOwner() return isOwner()
|| getProjectControl().isOwner() || getProjectControl().isOwner()
|| getRefControl().canEditAssignee() || getRefControl().canEditAssignee()

2
gerrit-server/src/main/java/com/google/gerrit/server/project/RefControl.java
View File

@@ -451,7 +451,7 @@ public class RefControl {
return canPerform(Permission.EDIT_HASHTAGS); return canPerform(Permission.EDIT_HASHTAGS);
} }
public boolean canEditAssignee() { boolean canEditAssignee() {
return canPerform(Permission.EDIT_ASSIGNEE); return canPerform(Permission.EDIT_ASSIGNEE);
} }