Merge lp:~adeuring/launchpad/bug-1086057 into lp:launchpad

[Abel Deuring]

change permissions for IProductSeries so that users with an artifact grant for a bug for a private product and linked to a milestone or product series can view these bugs.

fix for bug 1086057: Users with an artifact grant for a bug related to
a private product can't view the bug page

I filed this bug together with bug 1086043. The changes from the branch
that fixed 1086043 already allowed to view bugs of proprietary products,
when these bugs had only a bugtask for the product itself or when a
milestone is linked to the bugtask. Bugs with a task for a series of
the proprietary product needed some additional changes: Several
ProductSeries attributes need the permission lp.LimitedView instead
of lp.View.

These attributes are defined in IStructuralSubscriptionTarget and in
IBugTarget. registry/configure.zcml now specifies the permission
for each attribute of these interfaces individually, not for the
entire interfaces, similar to the permission definitions for these
attributes in IProduct.

Tests:

./bin/test bugs -vvt test_bug_views.TestMainBugView
./bin/test registry -vvt lp.registry.tests.test_productseries.ProductSeriesSecurityAdaperTestCase

no lint

[Abel Deuring (adeuring)]

here is the diff:

=== modified file 'lib/lp/bugs/browser/tests/test_bug_views.py'
--- lib/lp/bugs/browser/tests/test_bug_views.py 2012-11-12 11:33:18 +0000
+++ lib/lp/bugs/browser/tests/test_bug_views.py 2012-12-05 09:52:53 +0000
@@ -752,3 +752,55 @@
                 bug.default_bugtask, name='+activity')
             view.render()
         self.assertThat(recorder, HasQueryCount(Equals(7)))
+
+
+class TestMainBugView(BrowserTestCase):
+
+ layer = DatabaseFunctionalLayer
+
+ def setUp(self):
+ super(TestMainBugView, self).setUp()
+ self.user = self.factory.makePerson()
+ self.product_owner = self.factory.makePerson()
+ self.proprietary_product = self.factory.makeProduct(
+ owner=self.product_owner,
+ information_type=InformationType.PROPRIETARY)
+ with person_logged_in(self.product_owner):
+ self.series = self.factory.makeProductSeries(
+ product=self.proprietary_product)
+ self.milestone = self.factory.makeMilestone(
+ product=self.proprietary_product)
+ self.bug = self.factory.makeBug(
+ target=self.proprietary_product, owner=self.product_owner)
+ self.bug.subscribe(self.user, subscribed_by=self.product_owner)
+
+ def test_bug_page_user_with_aag_proprietary_product(self):
+ # A user with an artifact grant for a bug targeted to a private
+ # product can view the bug page.
+ with person_logged_in(self.user):
+ url = canonical_url(self.bug)
+ # No exception is raised when the page is rendered.
+ self.getUserBrowser(url, user=self.user)
+
+ def test_bug_page_user_with_aag_proprietary_product_milestone_linked(self):
+ # A user with an artifact grant for a bug targeted to a private
+ # product can view the bug page, even if the bug is linked to
+ # milestone.
+ with person_logged_in(self.product_owner):
+ self.bug.default_bugtask.transitionToMilestone(
+ self.milestone, self.product_owner)
+ with person_logged_in(self.user):
+ url = canonical_url(self.bug)
+ # No exception is raised when the page is rendered.
+ self.getUserBrowser(url, user=self.user)
+
+ def test_bug_page_user_with_aag_proprietary_product_task_for_series(self):
+ # A user with an artifact grant for a bug targeted to a private
+ # product series can view the bug page.
+ with person_logged_in(self.product_owner):
+ self.factory.makeBugTask(
+ bug=self.bug, target=self.series)
+ with person_logged_in(self.user):
+ url = canonical_url(self.bug)
+ # No exception is raised when the page is rendered.
+ self.getUserBrowser(url, user=self.user)

=== modified file 'lib/lp/registry/configure.zcml'
--- lib/lp/registry/configure.zcml 2012-12-04 13:52:02 +0000
+++ lib/lp/registry/configure.zcml 2012-12-05 09:49:10 +0000
@@ -1045,7 +1045,6 @@
                 productseries
                 series_target
                 summary
- title
                 "/>
         <require
             pe...

[Richard Harding (rharding)]

review: Approve