From 60b6490ced46dc053b34948344a510e00fbe6e77 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Tue, 5 Jul 2016 09:56:44 +0200 Subject: [PATCH] api: make comment_commits api have consistent permissions with web interface. --- rhodecode/api/views/repo_api.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/rhodecode/api/views/repo_api.py b/rhodecode/api/views/repo_api.py index de8e658d..733d0fad 100644 --- a/rhodecode/api/views/repo_api.py +++ b/rhodecode/api/views/repo_api.py @@ -1310,8 +1310,6 @@ def comment_commit( userid=Optional(OAttr('apiuser')), status=Optional(None)): """ Set a commit comment, and optionally change the status of the commit. - This command can be executed only using api_key belonging to user - with admin rights, or repository administrator. :param apiuser: This is filled automatically from the |authtoken|. :type apiuser: AuthUser @@ -1344,7 +1342,7 @@ def comment_commit( """ repo = get_repo_or_error(repoid) if not has_superadmin_permission(apiuser): - _perms = ('repository.admin',) + _perms = ('repository.read', 'repository.write', 'repository.admin') has_repo_permissions(apiuser, repoid, repo, _perms) if isinstance(userid, Optional):