release: merge back stable branch into default

docs/release-notes/release-notes-4.16.2.rst

@@ -0,0 +1,41 @@
+|RCE| 4.16.2 |RNS|
+------------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2019-04-02
+
+
+New Features
+^^^^^^^^^^^^
+
+
+
+General
+^^^^^^^
+
+
+
+Security
+^^^^^^^^
+
+
+
+Performance
+^^^^^^^^^^^
+
+
+
+Fixes
+^^^^^
+
+- Integrations: fixed missing template variable for fork reference checks.
+- Permissions: fixed server error when showing permissions for user groups.
+- Pull requests: fixed a bug in removal of multiple reviewers at once.
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- Scheduled release addressing problems in 4.16.X releases.

docs/release-notes/release-notes.rst

@@ -9,6 +9,7 @@ Release Notes
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.16.2.rst
    release-notes-4.16.1.rst
    release-notes-4.16.0.rst
    release-notes-4.15.2.rst

rhodecode/apps/repository/views/repo_settings_advanced.py

@@ -67,12 +67,6 @@ class RepoSettingsView(RepoAppView):
             .filter(UserFollowing.user_id == c.default_user_id) \
             .filter(UserFollowing.follows_repository == self.db_repo).scalar()
 
-        c.has_origin_repo_read_perm = False
-        if self.db_repo.fork:
-            c.has_origin_repo_read_perm = h.HasRepoPermissionAny(
-                'repository.write', 'repository.read', 'repository.admin')(
-                self.db_repo.fork.repo_name, 'repo set as fork page')
-
         c.ver_info_dict = self.rhodecode_vcs_repo.get_hooks_info()
 
         return self._get_template_context(c)

rhodecode/integrations/views.py

@@ -114,7 +114,6 @@ class IntegrationSettingsViewBase(BaseAppView):
         _ = self.request.translate
         c = super(IntegrationSettingsViewBase, self)._get_local_tmpl_context(
             include_app_defaults=include_app_defaults)
-
         c.active = 'integrations'
 
         return c
@@ -404,6 +403,11 @@ class RepoIntegrationsView(IntegrationSettingsViewBase):
         c.repo_name = self.db_repo.repo_name
         c.repository_pull_requests = ScmModel().get_pull_requests(self.repo)
 
+        c.has_origin_repo_read_perm = False
+        if self.db_repo.fork:
+            c.has_origin_repo_read_perm = h.HasRepoPermissionAny(
+                'repository.write', 'repository.read', 'repository.admin')(
+                self.db_repo.fork.repo_name, 'summary fork link')
         return c
 
     @LoginRequired()

rhodecode/model/pull_request.py

@@ -1020,6 +1020,9 @@ class PullRequestModel(BaseModel):
         log.debug("Adding %s reviewers", ids_to_add)
         log.debug("Removing %s reviewers", ids_to_remove)
         changed = False
+        added_audit_reviewers = []
+        removed_audit_reviewers = []
+
         for uid in ids_to_add:
             changed = True
             _usr = self._get_user(uid)
@@ -1030,29 +1033,37 @@ class PullRequestModel(BaseModel):
             # NOTE(marcink): mandatory shouldn't be changed now
             # reviewer.mandatory = reviewers[uid]['reasons']
             Session().add(reviewer)
-            self._log_audit_action(
-                'repo.pull_request.reviewer.add', {'data': reviewer.get_dict()},
-                user, pull_request)
+            added_audit_reviewers.append(reviewer.get_dict())
 
         for uid in ids_to_remove:
             changed = True
+            # NOTE(marcink): we fetch "ALL" reviewers using .all(). This is an edge case
+            # that prevents and fixes cases that we added the same reviewer twice.
+            # this CAN happen due to the lack of DB checks
             reviewers = PullRequestReviewers.query()\
                 .filter(PullRequestReviewers.user_id == uid,
                         PullRequestReviewers.pull_request == pull_request)\
                 .all()
-            # use .all() in case we accidentally added the same person twice
-            # this CAN happen due to the lack of DB checks
+
             for obj in reviewers:
-                old_data = obj.get_dict()
+                added_audit_reviewers.append(obj.get_dict())
                 Session().delete(obj)
-                self._log_audit_action(
-                    'repo.pull_request.reviewer.delete',
-                    {'old_data': old_data}, user, pull_request)
 
         if changed:
+            Session().expire_all()
             pull_request.updated_on = datetime.datetime.now()
             Session().add(pull_request)
 
+        # finally store audit logs
+        for user_data in added_audit_reviewers:
+            self._log_audit_action(
+                'repo.pull_request.reviewer.add', {'data': user_data},
+                user, pull_request)
+        for user_data in removed_audit_reviewers:
+            self._log_audit_action(
+                'repo.pull_request.reviewer.delete', {'old_data': user_data},
+                user, pull_request)
+
         self.notify_reviewers(pull_request, ids_to_add)
         return ids_to_add, ids_to_remove