engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

watch: add permission check for repo action.

Browse source
This commit is contained in:
Marcin Lulek 2019-05-16 23:18:23 +02:00
parent 5a52f5a92d
commit 0c8d73356c
1 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
rhodecode/apps/journal/views.py
View file

@ -31,12 +31,12 @@ from pyramid.renderers import render
from rhodecode.apps._base import BaseAppView
from rhodecode.model.db import (
or_, joinedload, UserLog, UserFollowing, User, UserApiKeys)
or_, joinedload, Repository, UserLog, UserFollowing, User, UserApiKeys)
from rhodecode.model.meta import Session
import rhodecode.lib.helpers as h
from rhodecode.lib.helpers import Page
from rhodecode.lib.user_log_filter import user_log_filter
from rhodecode.lib.auth import LoginRequired, NotAnonymous, CSRFRequired
from rhodecode.lib.auth import LoginRequired, NotAnonymous, CSRFRequired, HasRepoPermissionAny
from rhodecode.lib.utils2 import safe_int, AttributeDict, md5_safe
from rhodecode.model.scm import ScmModel
@ -304,7 +304,10 @@ class JournalView(BaseAppView):
raise HTTPBadRequest()
repo_id = self.request.POST.get('follows_repo_id')
if repo_id:
repo = Repository.get_or_404(repo_id)
perm_set = ['repository.read', 'repository.write', 'repository.admin']
has_perm = HasRepoPermissionAny(*perm_set)(repo.repo_name, 'RepoWatch check')
if repo and has_perm:
try:
ScmModel().toggle_following_repo(repo_id, self._rhodecode_user.user_id)
Session().commit()