Changeset - 516a43cbd814
Parent rev.
Child rev.
[Not reviewed]
Merge default
0 3 0
Mads Kiilerich (mads) - 5 years ago 2021-01-07 03:28:37
mads@kiilerich.com
Merge stable
3 files changed with 46 insertions and 40 deletions:
kallithea/controllers/api/api.py
36
24
kallithea/templates/admin/permissions/permissions_globals.html
1
kallithea/tests/api/api_base.py
10
15
0 comments (0 inline, 0 general)
kallithea/controllers/api/api.py
➞
Show inline comments
 
@@ -1159,13 +1159,13 @@ class ApiController(JSONRPCController):
 
        except Exception:
 
            log.error(traceback.format_exc())
 
            raise JSONRPCError(
 
                'failed to get repo: `%s` nodes' % repo.repo_name
 
            )
 

			




	
	
	
		
 
    @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')

			




	
	
	
		
 
    # permission check inside

			




	
	
	
		
 
    def create_repo(self, repo_name, owner=None,

			




	
	
	
		
 
                    repo_type=None, description='',

			




	
	
	
		
 
                    private=False, clone_uri=None,

			




	
	
	
		
 
                    landing_rev='rev:tip',

			




	
	
	
		
 
                    enable_statistics=None,

			




	
	
	
		
 
                    enable_downloads=None,

			




	
	
		
 
@@ -1216,12 +1216,25 @@ class ApiController(JSONRPCController):

			




	
	
	
		
 
          result : null

			




	
	
	
		
 
          error :  {

			




	
	
	
		
 
             'failed to create repository `<repo_name>`

			




	
	
	
		
 
          }

			




	
	
	
		
 

			




	
	
	
		
 
        """

			




	
	
	
		
 
        group_name = None

			




	
	
	
		
 
        repo_name_parts = repo_name.split('/')

			




	
	
	
		
 
        if len(repo_name_parts) > 1:

			




	
	
	
		
 
            group_name = '/'.join(repo_name_parts[:-1])

			




	
	
	
		
 
            repo_group = db.RepoGroup.get_by_group_name(group_name)

			




	
	
	
		
 
            if repo_group is None:

			




	
	
	
		
 
                raise JSONRPCError("repo group `%s` not found" % group_name)

			




	
	
	
		
 
            if not(HasPermissionAny('hg.admin')() or HasRepoGroupPermissionLevel('write')(group_name)):

			




	
	
	
		
 
                raise JSONRPCError("no permission to create repo in %s" % group_name)

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            if not HasPermissionAny('hg.admin', 'hg.create.repository')():

			




	
	
	
		
 
                raise JSONRPCError("no permission to create top level repo")

			




	
	
	
		
 

			




	
	
	
		
 
        if not HasPermissionAny('hg.admin')():

			




	
	
	
		
 
            if owner is not None:

			




	
	
	
		
 
                # forbid setting owner for non-admins

			




	
	
	
		
 
                raise JSONRPCError(

			




	
	
	
		
 
                    'Only Kallithea admin can specify `owner` param'

			




	
	
	
		
 
                )

			




	
	
		
 
@@ -1241,27 +1254,20 @@ class ApiController(JSONRPCController):

			




	
	
	
		
 
        if enable_statistics is None:

			




	
	
	
		
 
            enable_statistics = defs.get('repo_enable_statistics')

			




	
	
	
		
 
        if enable_downloads is None:

			




	
	
	
		
 
            enable_downloads = defs.get('repo_enable_downloads')

			




	
	
	
		
 

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            repo_name_parts = repo_name.split('/')

			




	
	
	
		
 
            repo_group = None

			




	
	
	
		
 
            if len(repo_name_parts) > 1:

			




	
	
	
		
 
                group_name = '/'.join(repo_name_parts[:-1])

			




	
	
	
		
 
                repo_group = db.RepoGroup.get_by_group_name(group_name)

			




	
	
	
		
 
                if repo_group is None:

			




	
	
	
		
 
                    raise JSONRPCError("repo group `%s` not found" % group_name)

			




	
	
	
		
 
            data = dict(

			




	
	
	
		
 
                repo_name=repo_name_parts[-1],

			




	
	
	
		
 
                repo_name_full=repo_name,

			




	
	
	
		
 
                repo_type=repo_type,

			




	
	
	
		
 
                repo_description=description,

			




	
	
	
		
 
                repo_private=private,

			




	
	
	
		
 
                clone_uri=clone_uri,

			




	
	
	
		
 
                repo_group=repo_group,

			




	
	
	
		
 
                repo_group=group_name,

			




	
	
	
		
 
                repo_landing_rev=landing_rev,

			




	
	
	
		
 
                enable_statistics=enable_statistics,

			




	
	
	
		
 
                enable_downloads=enable_downloads,

			




	
	
	
		
 
                repo_copy_permissions=copy_permissions,

			




	
	
	
		
 
            )

			




	
	
	
		
 

			




	
	
		
 
@@ -1303,27 +1309,30 @@ class ApiController(JSONRPCController):

			




	
	
	
		
 
        """

			




	
	
	
		
 
        repo = get_repo_or_error(repoid)

			




	
	
	
		
 
        if not HasPermissionAny('hg.admin')():

			




	
	
	
		
 
            if not HasRepoPermissionLevel('admin')(repo.repo_name):

			




	
	
	
		
 
                raise JSONRPCError('repository `%s` does not exist' % (repoid,))

			




	
	
	
		
 

			




	
	
	
		
 
            if (name != repo.repo_name and

			




	
	
	
		
 
            if (name != repo.repo_name and repo.group_id is None and

			




	
	
	
		
 
                not HasPermissionAny('hg.create.repository')()

			




	
	
	
		
 
            ):

			




	
	
	
		
 
                raise JSONRPCError('no permission to create (or move) repositories')

			




	
	
	
		
 
                raise JSONRPCError('no permission to create (or move) top level repositories')

			




	
	
	
		
 

			




	
	
	
		
 
            if owner is not None:

			




	
	
	
		
 
                # forbid setting owner for non-admins

			




	
	
	
		
 
                raise JSONRPCError(

			




	
	
	
		
 
                    'Only Kallithea admin can specify `owner` param'

			




	
	
	
		
 
                )

			




	
	
	
		
 

			




	
	
	
		
 
        updates = {}

			




	
	
	
		
 
        repo_group = group

			




	
	
	
		
 
        if repo_group is not None:

			




	
	
	
		
 
            repo_group = get_repo_group_or_error(repo_group)

			




	
	
	
		
 
            repo_group = get_repo_group_or_error(repo_group)  # TODO: repos can thus currently not be moved to root

			




	
	
	
		
 
            if repo_group.group_id != repo.group_id:

			




	
	
	
		
 
                if not(HasPermissionAny('hg.admin')() or HasRepoGroupPermissionLevel('write')(repo_group.group_name)):

			




	
	
	
		
 
                    raise JSONRPCError("no permission to create (or move) repo in %s" % repo_group.group_name)

			




	
	
	
		
 
            repo_group = repo_group.group_id

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            store_update(updates, name, 'repo_name')

			




	
	
	
		
 
            store_update(updates, repo_group, 'repo_group')

			




	
	
	
		
 
            store_update(updates, owner, 'owner')

			




	
	
	
		
 
            store_update(updates, description, 'repo_description')

			




	
	
		
 
@@ -1340,12 +1349,13 @@ class ApiController(JSONRPCController):

			




	
	
	
		
 
                repository=repo.get_api_data()

			




	
	
	
		
 
            )

			




	
	
	
		
 
        except Exception:

			




	
	
	
		
 
            log.error(traceback.format_exc())

			




	
	
	
		
 
            raise JSONRPCError('failed to update repo `%s`' % repoid)

			




	
	
	
		
 

			




	
	
	
		
 
    # permission check inside

			




	
	
	
		
 
    @HasPermissionAnyDecorator('hg.admin', 'hg.fork.repository')

			




	
	
	
		
 
    def fork_repo(self, repoid, fork_name,

			




	
	
	
		
 
                  owner=None,

			




	
	
	
		
 
                  description='', copy_permissions=False,

			




	
	
	
		
 
                  private=False, landing_rev='rev:tip'):

			




	
	
	
		
 
        """

			




	
	
		
 
@@ -1394,44 +1404,46 @@ class ApiController(JSONRPCController):

			




	
	
	
		
 

			




	
	
	
		
 
        _repo = RepoModel().get_by_repo_name(fork_name)

			




	
	
	
		
 
        if _repo:

			




	
	
	
		
 
            type_ = 'fork' if _repo.fork else 'repo'

			




	
	
	
		
 
            raise JSONRPCError("%s `%s` already exist" % (type_, fork_name))

			




	
	
	
		
 

			




	
	
	
		
 
        group_name = None

			




	
	
	
		
 
        fork_name_parts = fork_name.split('/')

			




	
	
	
		
 
        if len(fork_name_parts) > 1:

			




	
	
	
		
 
            group_name = '/'.join(fork_name_parts[:-1])

			




	
	
	
		
 
            repo_group = db.RepoGroup.get_by_group_name(group_name)

			




	
	
	
		
 
            if repo_group is None:

			




	
	
	
		
 
                raise JSONRPCError("repo group `%s` not found" % group_name)

			




	
	
	
		
 
            if not(HasPermissionAny('hg.admin')() or HasRepoGroupPermissionLevel('write')(group_name)):

			




	
	
	
		
 
                raise JSONRPCError("no permission to create repo in %s" % group_name)

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            if not HasPermissionAny('hg.admin', 'hg.create.repository')():

			




	
	
	
		
 
                raise JSONRPCError("no permission to create top level repo")

			




	
	
	
		
 

			




	
	
	
		
 
        if HasPermissionAny('hg.admin')():

			




	
	
	
		
 
            pass

			




	
	
	
		
 
        elif HasRepoPermissionLevel('read')(repo.repo_name):

			




	
	
	
		
 
            if owner is not None:

			




	
	
	
		
 
                # forbid setting owner for non-admins

			




	
	
	
		
 
                raise JSONRPCError(

			




	
	
	
		
 
                    'Only Kallithea admin can specify `owner` param'

			




	
	
	
		
 
                )

			




	
	
	
		
 

			




	
	
	
		
 
            if not HasPermissionAny('hg.create.repository')():

			




	
	
	
		
 
                raise JSONRPCError('no permission to create repositories')

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            raise JSONRPCError('repository `%s` does not exist' % (repoid,))

			




	
	
	
		
 

			




	
	
	
		
 
        if owner is None:

			




	
	
	
		
 
            owner = request.authuser.user_id

			




	
	
	
		
 

			




	
	
	
		
 
        owner = get_user_or_error(owner)

			




	
	
	
		
 

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            fork_name_parts = fork_name.split('/')

			




	
	
	
		
 
            repo_group = None

			




	
	
	
		
 
            if len(fork_name_parts) > 1:

			




	
	
	
		
 
                group_name = '/'.join(fork_name_parts[:-1])

			




	
	
	
		
 
                repo_group = db.RepoGroup.get_by_group_name(group_name)

			




	
	
	
		
 
                if repo_group is None:

			




	
	
	
		
 
                    raise JSONRPCError("repo group `%s` not found" % group_name)

			




	
	
	
		
 

			




	
	
	
		
 
            form_data = dict(

			




	
	
	
		
 
                repo_name=fork_name_parts[-1],

			




	
	
	
		
 
                repo_name_full=fork_name,

			




	
	
	
		
 
                repo_group=repo_group,

			




	
	
	
		
 
                repo_group=group_name,

			




	
	
	
		
 
                repo_type=repo.repo_type,

			




	
	
	
		
 
                description=description,

			




	
	
	
		
 
                private=private,

			




	
	
	
		
 
                copy_permissions=copy_permissions,

			




	
	
	
		
 
                landing_rev=landing_rev,

			




	
	
	
		
 
                update_after_clone=False,

			




        

    


    
    

    

        

                

                    kallithea/templates/admin/permissions/permissions_globals.html
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -51,13 +51,12 @@ ${h.form(url('admin_permissions'), metho

			




	
	
	
		
 
            </div>

			




	
	
	
		
 
            <div class="form-group">

			




	
	
	
		
 
                <label class="control-label" for="default_repo_create">${_('Top level repository creation')}:</label>

			




	
	
	
		
 
                <div>

			




	
	
	
		
 
                    ${h.select('default_repo_create','',c.repo_create_choices,class_='form-control')}

			




	
	
	
		
 
                    <span class="help-block">${_('Enable this to allow non-admins to create repositories at the top level.')}</span>

			




	
	
	
		
 
                    <span class="help-block">${_('Note: This will also give all users API access to create repositories everywhere. That might change in future versions.')}</span>

			




	
	
	
		
 
                </div>

			




	
	
	
		
 
            </div>

			




	
	
	
		
 
            <div class="form-group">

			




	
	
	
		
 
                <label class="control-label" for="default_user_group_create">${_('User group creation')}:</label>

			




	
	
	
		
 
                <div>

			




	
	
	
		
 
                    ${h.select('default_user_group_create','',c.user_group_create_choices,class_='form-control')}

			




        

    


    
    

    

        

                

                    kallithea/tests/api/api_base.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -884,25 +884,17 @@ class _BaseTestApi(object):

			




	
	
	
		
 
        id_, params = _build_data(self.apikey_regular, 'create_repo',

			




	
	
	
		
 
                                  repo_name=repo_name,

			




	
	
	
		
 
                                  repo_type=self.REPO_TYPE,

			




	
	
	
		
 
        )

			




	
	
	
		
 
        response = api_call(self, params)

			




	
	
	
		
 

			




	
	
	
		
 
        # Current result when API access control is different from Web:

			




	
	
	
		
 
        ret = {

			




	
	
	
		
 
            'msg': 'Created new repository `%s`' % repo_name,

			




	
	
	
		
 
            'success': True,

			




	
	
	
		
 
        }

			




	
	
	
		
 
        expected = ret

			




	
	
	
		
 
        self._compare_ok(id_, expected, given=response.body)

			




	
	
	
		
 
        # API access control match Web access control:

			




	
	
	
		
 
        expected = 'no permission to create repo in test_repo_group/api-repo-repo'

			




	
	
	
		
 
        self._compare_error(id_, expected, given=response.body)

			




	
	
	
		
 

			




	
	
	
		
 
        fixture.destroy_repo(repo_name)

			




	
	
	
		
 

			




	
	
	
		
 
        # Expected and arguably more correct result:

			




	
	
	
		
 
        #expected = 'failed to create repository `%s`' % repo_name

			




	
	
	
		
 
        #self._compare_error(id_, expected, given=response.body)

			




	
	
	
		
 

			




	
	
	
		
 
        fixture.destroy_repo_group(repo_group_name)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_api_create_repo_unknown_owner(self):

			




	
	
	
		
 
        repo_name = 'api-repo'

			




	
	
	
		
 
        owner = 'i-dont-exist'

			




	
	
	
		
 
        id_, params = _build_data(self.apikey, 'create_repo',

			




	
	
		
 
@@ -1118,13 +1110,13 @@ class _BaseTestApi(object):

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            expected = 'failed to update repo `%s`' % repo_name

			




	
	
	
		
 
            self._compare_error(id_, expected, given=response.body)

			




	
	
	
		
 
        finally:

			




	
	
	
		
 
            fixture.destroy_repo(repo_name)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_api_update_repo_regular_user_change_repo_name(self):

			




	
	
	
		
 
    def test_api_update_repo_regular_user_change_top_level_repo_name(self):

			




	
	
	
		
 
        repo_name = 'admin_owned'

			




	
	
	
		
 
        new_repo_name = 'new_repo_name'

			




	
	
	
		
 
        fixture.create_repo(repo_name, repo_type=self.REPO_TYPE)

			




	
	
	
		
 
        RepoModel().grant_user_permission(repo=repo_name,

			




	
	
	
		
 
                                          user=self.TEST_USER_LOGIN,

			




	
	
	
		
 
                                          perm='repository.admin')

			




	
	
		
 
@@ -1132,13 +1124,13 @@ class _BaseTestApi(object):

			




	
	
	
		
 
        UserModel().grant_perm('default', 'hg.create.none')

			




	
	
	
		
 
        updates = {'name': new_repo_name}

			




	
	
	
		
 
        id_, params = _build_data(self.apikey_regular, 'update_repo',

			




	
	
	
		
 
                                  repoid=repo_name, **updates)

			




	
	
	
		
 
        response = api_call(self, params)

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            expected = 'no permission to create (or move) repositories'

			




	
	
	
		
 
            expected = 'no permission to create (or move) top level repositories'

			




	
	
	
		
 
            self._compare_error(id_, expected, given=response.body)

			




	
	
	
		
 
        finally:

			




	
	
	
		
 
            fixture.destroy_repo(repo_name)

			




	
	
	
		
 
            fixture.destroy_repo(new_repo_name)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_api_update_repo_regular_user_change_repo_name_allowed(self):

			




	
	
		
 
@@ -1262,12 +1254,15 @@ class _BaseTestApi(object):

			




	
	
	
		
 

			




	
	
	
		
 
    @base.parametrize('fork_name', [

			




	
	
	
		
 
        'api-repo-fork',

			




	
	
	
		
 
        '%s/api-repo-fork' % TEST_REPO_GROUP,

			




	
	
	
		
 
    ])

			




	
	
	
		
 
    def test_api_fork_repo_non_admin(self, fork_name):

			




	
	
	
		
 
        RepoGroupModel().grant_user_permission(TEST_REPO_GROUP,

			




	
	
	
		
 
                                               self.TEST_USER_LOGIN,

			




	
	
	
		
 
                                               'group.write')

			




	
	
	
		
 
        id_, params = _build_data(self.apikey_regular, 'fork_repo',

			




	
	
	
		
 
                                  repoid=self.REPO,

			




	
	
	
		
 
                                  fork_name=fork_name,

			




	
	
	
		
 
        )

			




	
	
	
		
 
        response = api_call(self, params)

			




	
	
	
		
 

			




	
	
		
 
@@ -1327,13 +1322,13 @@ class _BaseTestApi(object):

			




	
	
	
		
 
        UserModel().grant_perm('default', 'hg.create.none')

			




	
	
	
		
 
        id_, params = _build_data(self.apikey_regular, 'fork_repo',

			




	
	
	
		
 
                                  repoid=self.REPO,

			




	
	
	
		
 
                                  fork_name=fork_name,

			




	
	
	
		
 
        )

			




	
	
	
		
 
        response = api_call(self, params)

			




	
	
	
		
 
        expected = 'no permission to create repositories'

			




	
	
	
		
 
        expected = 'no permission to create top level repo'

			




	
	
	
		
 
        self._compare_error(id_, expected, given=response.body)

			




	
	
	
		
 
        fixture.destroy_repo(fork_name)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_api_fork_repo_unknown_owner(self):

			




	
	
	
		
 
        fork_name = 'api-repo-fork'

			




	
	
	
		
 
        owner = 'i-dont-exist'

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        Server instance: clio-24903
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.
            – Support