Merge lp:~allenap/launchpad/fix-permissions-bug-547063 into lp:launchpad/db-devel

[Gavin Panella]

Fix permissions so that only users who can modify the bug can link or unlink branches.

Fixes the permissions for Bug.linkBranch and Bug.unlinkBranch so that only users who have permissions to modify the bug can link or unlink branches.

[Abel Deuring (adeuring)]

review: Approve (code)

[Deryck Hodge (deryck)]

review: Approve (release-critical)

=== modified file 'lib/lp/bugs/configure.zcml'
--- lib/lp/bugs/configure.zcml	2010-03-26 13:48:53 +0000
+++ lib/lp/bugs/configure.zcml	2010-03-30 10:36:33 +0000
@@ -583,8 +583,6 @@
                     getDirectSubscribers
                     getDirectSubscriptions
                     getIndirectSubscribers
-                    linkBranch
-                    unlinkBranch
                     mentoring_offers
                     canMentor
                     isMentor
@@ -690,6 +688,8 @@
                     markAsDuplicate
                     linkHWSubmission
                     unlinkHWSubmission
+                    linkBranch
+                    unlinkBranch
                     linkAttachment"
                 set_attributes="
                     activity initial_message
 
=== modified file 'lib/lp/bugs/doc/bug-branch.txt'
--- lib/lp/bugs/doc/bug-branch.txt	2009-08-13 15:12:16 +0000
+++ lib/lp/bugs/doc/bug-branch.txt	2010-03-30 10:36:33 +0000
@@ -66,14 +66,12 @@
     >>> branch = getUtility(IBranchLookup).get(1)
     >>> bug_branch_three = bug.linkBranch(branch, user)
 
-
-If we make the bug private, no-priv won't be allowed to edit neither the
-bug nor the BugBranch.
+If we make the bug private, no-priv won't be allowed to edit either
+the bug or the BugBranch.
 
     >>> login('[e-mail]')
     >>> bug.setPrivate(True, getUtility(ILaunchBag).user)
     True
-
     >>> login('[e-mail]')
 
     >>> bug.description = 'Yet another description.'
@@ -81,9 +79,35 @@
     ...
     Unauthorized:...
 
+    >>> bug.unlinkBranch(branch, getUtility(ILaunchBag).user)
+    Traceback (most recent call last):
+    ...
+    Unauthorized:...
+
+    >>> another_branch = factory.makeAnyBranch()
+    >>> bug.linkBranch(another_branch, getUtility(ILaunchBag).user)
+    Traceback (most recent call last):
+    ...
+    Unauthorized:...
+
     >>> login('[e-mail]')
     >>> bug.setPrivate(False, getUtility(ILaunchBag).user)
     True
+
+Likewise, anonymous users cannot link or unlink branches.
+
+    >>> login(ANONYMOUS)
+
+    >>> bug.unlinkBranch(branch, getUtility(ILaunchBag).user)
+    Traceback (most recent call last):
+    ...
+    Unauthorized:...
+
+    >>> bug.linkBranch(another_branch, getUtility(ILaunchBag).user)
+    Traceback (most recent call last):
+    ...
+    Unauthorized:...
+
     >>> login('[e-mail]')
 
 You can unlink a branch from a bug using unlinkBranch().
 
=== modified file 'lib/lp/code/browser/tests/test_branchlisting.py'
--- lib/lp/code/browser/tests/test_branchlisting.py	2009-11-06 21:06:38 +0000
+++ lib/lp/code/browser/tests/test_branchlisting.py	2010-03-30 10:36:33 +0000
@@ -26,7 +26,8 @@
 from lp.registry.model.person import Owner
 from lp.registry.model.product import Product
 from lp.registry.interfaces.pocket import PackagePublishingPocket
-from lp.testing import TestCase, TestCaseWithFactory, time_counter
+from lp.testing import (
+    TestCase, TestCaseWithFactory, login_person, time_counter)
 from lp.testing.views import create_initialized_view
 from canonical.launchpad.webapp import canonical_url
 from canonical.launchpad.webapp.servers import LaunchpadTestRequest
@@ -98,6 +99,9 @@
 
     def setUp(self):
         TestCaseWithFactory.setUp(self)
+        self.user = self.factory.makePerson()
+        login_person(self.user)
+
         self.barney = self.factory.makePerson(name='barney')
         self.bambam = self.factory.makeProduct(name='bambam')
 
 
=== modified file 'lib/lp/code/model/tests/test_branch.py'
--- lib/lp/code/model/tests/test_branch.py	2010-03-18 17:49:21 +0000
+++ lib/lp/code/model/tests/test_branch.py	2010-03-30 10:36:33 +0000
@@ -1732,6 +1732,7 @@
     def setUp(self):
         TestCaseWithFactory.setUp(self)
         self.user = self.factory.makePerson()
+        login_person(self.user)
 
     def test_bug_link(self):
         # Branches can be linked to bugs through the Branch interface.
 
=== modified file 'lib/lp/code/model/tests/test_branchmergeproposals.py'
--- lib/lp/code/model/tests/test_branchmergeproposals.py	2010-03-04 16:44:23 +0000
+++ lib/lp/code/model/tests/test_branchmergeproposals.py	2010-03-30 10:36:33 +0000
@@ -1146,6 +1146,11 @@
 
     layer = DatabaseFunctionalLayer
 
+    def setUp(self):
+        TestCaseWithFactory.setUp(self)
+        self.user = self.factory.makePerson()
+        login_person(self.user)
+
     def test_related_bugs_includes_source_bugs(self):
         """related_bugs includes bugs linked to the source branch."""
         bmp = self.factory.makeBranchMergeProposal()
 
=== modified file 'lib/lp/code/windmill/tests/test_branch_popupdiff.py'
--- lib/lp/code/windmill/tests/test_branch_popupdiff.py	2010-02-01 18:37:00 +0000
+++ lib/lp/code/windmill/tests/test_branch_popupdiff.py	2010-03-30 10:36:33 +0000
@@ -12,11 +12,12 @@
 import windmill
 
 from canonical.launchpad.windmill.testing.constants import PAGE_LOAD
-from canonical.launchpad.windmill.testing.lpuser import login_person
+from canonical.launchpad.windmill.testing.lpuser import (
+    login_person as windmill_login_person)
 from lp.bugs.windmill.testing import BugsWindmillLayer
 from lp.code.tests.helpers import make_erics_fooix_project
 from lp.code.windmill.testing import CodeWindmillLayer
-from lp.testing import WindmillTestCase
+from lp.testing import WindmillTestCase, login_person
 
 
 POPUP_DIFF = (
@@ -81,6 +82,11 @@
     layer = BugsWindmillLayer
     name = "Bug popup diffs"
 
+    def setUp(self):
+        WindmillTestCase.setUp(self)
+        self.user = self.factory.makePerson()
+        login_person(self.user)
+
     def test_bug_popup_diff(self):
         """Test bug page diff popups."""
         client = self.client
@@ -114,7 +120,7 @@
         bug = self.factory.makeBug(product=objs['fooix'])
         transaction.commit()
 
-        login_person(objs['eric'], "test", client)
+        windmill_login_person(objs['eric'], "test", client)
 
         start_url = (windmill.settings['TEST_URL'] + 'bugs/%d' % bug.id)
         client.open(url=start_url)