Merge lp:~wallyworld/launchpad/delete-bugtask-ui-878909 into lp:launchpad

[Ian Booth]

[r=sinzui][bug=878909] Update the ui to support bugtask deletion.

Update the ui to support bugtask deletion.

== Implementation ==

Add a new BugTaskDeleteView and render delete icons next to each bug task that can be deleted by the logged in user.
This mp performs the delete using html forms. A subsequent branch will provide ajax support.

The permission checking code was moved from the security adaptor to a method on BugTask so it could be reused by the view.
To recap: the delete capability is protected by a feature flag, is restricted to certain roles, and the last bug tasks for a bug cannot be deleted.

A change was made to the lazr-js activator css to ensure the edit icon lines up properly.

== Demo and QA ==

The delete icons are rendered as shown in the screenshot.

http://people.canonical.com/~ianb/bugtask-delete-icons.png

== Tests ==

Add tests to browser/tests/test_bugtask:

TestBugTaskDeleteLinks
(test that the delete links/icons are rendered as expected)

TestBugTaskDeleteView
(test that the delete view itself works as expected)

== Lint ==

Checking for conflicts and issues in changed files.

Linting changed files:
  lib/lp/app/javascript/activator/assets/skins/sam/activator-skin.css
  lib/lp/bugs/configure.zcml
  lib/lp/bugs/security.py
  lib/lp/bugs/browser/bugtask.py
  lib/lp/bugs/browser/configure.zcml
  lib/lp/bugs/browser/tests/test_bugtask.py
  lib/lp/bugs/interfaces/bugtask.py
  lib/lp/bugs/model/bugtask.py
  lib/lp/bugs/templates/bugtask-delete.pt
  lib/lp/bugs/templates/bugtask-tasks-and-nominations-table-row.pt

[Curtis Hovey (sinzui)]

Hi Ian.

I have a few concerns about the safety and maintainability of of two changes. I have some suggestions and questions too.

> === modified file 'lib/lp/bugs/browser/bugtask.py'
> --- lib/lp/bugs/browser/bugtask.py 2011-10-19 14:54:07 +0000
> +++ lib/lp/bugs/browser/bugtask.py 2011-10-25 08:17:26 +0000
> @@ -1757,6 +1758,38 @@
> self.updateContextFromData(data)
>
>
> +class BugTaskDeletionView(LaunchpadFormView):
> + """Used to delete a bugtask."""
> +
> + schema = IBugTask
> + field_names = []
> +
> + label = 'Remove bug task'
> + page_title = label
> +
> + @property
> + def confirmation_message(self):
> + return ('<p>You are about to mark bug %s<br>'
> + 'as no longer affecting %s.</p>'
> + '<p>This operation will be permanent and cannot be '
> + 'undone.</p>'
> + % (self.context.bug.title,
> + self.context.target.bugtargetdisplayname))

This is dangerous. Both title and displayname may *always* contain
markup. We use structured() to build safe interpolated messages.

Would direct language be more effective at conveying the consequences of the
action:
    Deletion is permanent, it cannot be undone.

...

> @@ -3552,6 +3585,8 @@
> row_css_class='highlight' if is_primary else None,
> target_link=canonical_url(self.context.target),
> target_link_title=self.target_link_title,
> + user_can_delete=self.user_can_delete_bugtask,
> + delete_link=link + '/+delete',

While I am certain this link will work, but it is a crafted link we need to
maintain with extra testing.
    canonical_url(self.context.target, view_name='+delete')
will raise an exception if the named view is unregistered.

> === modified file 'lib/lp/bugs/browser/tests/test_bugtask.py'
> --- lib/lp/bugs/browser/tests/test_bugtask.py 2011-10-05 18:02:45 +0000
> +++ lib/lp/bugs/browser/tests/test_bugtask.py 2011-10-25 08:17:26 +0000
> @@ -606,6 +614,99 @@
> self.assertIn(series.product.displayname, content)
>
>
> +class TestBugTaskDeleteLinks(TestCaseWithFactory):
> + """ Test that the delete icons/links for each relevant bug task are
> + correctly rendered.
> +
> + Bug task deletion is protected by a feature flag.
> + """

The first line may not wrap according to PEP 256.

+ layer = DatabaseFunctionalLayer
+
+ def test_cannot_delete_only_bugtask(self):
+ # The last bugtask cannot be deleted.
+ bug = self.factory.makeBug()
+ login_person(bug.owner)
+ view = create_initialized_view(
+ bug, name='+bugtasks-and-nominations-table')
+ row_view = view._getTableRowView(bug.default_bugtask, False, False)
+ self.assertFalse(row_view.user_can_delete_bugtask)
+ del get_property_cache(row_view).user_can_delete_bugtask
+ with FeatureFixture(DELETE_BUGTASK_ENABLED):
+ self.assertFalse(row_view.user_can_delete_bugtask)
+
+ def test_can_delete_bugtask_if_authorised(self):
+ # The bugtask can be deleted if the user if authorised.
+ bug = self.factory.makeBug()
+ bugtask = self.fac...

review: Needs Fixing (code)

[Ian Booth (wallyworld)]

Hi

Thanks for the excellent review.

>
> This is dangerous. Both title and displayname may *always* contain
> markup. We use structured() to build safe interpolated messages.
>

I originally tried using structured() but the legit html in the message
got escaped. I suspect I may have messed up using the api and had meant
to come back to look at it again but forgot. I'll take another look.

> Would direct language be more effective at conveying the consequences of the
> action:
> Deletion is permanent, it cannot be undone.
>

Sure.

>> + user_can_delete=self.user_can_delete_bugtask,
>> + delete_link=link + '/+delete',
>
> While I am certain this link will work, but it is a crafted link we need to
> maintain with extra testing.
> canonical_url(self.context.target, view_name='+delete')
> will raise an exception if the named view is unregistered.
>

Yes, much better, thanks.

>>
>> +class TestBugTaskDeleteLinks(TestCaseWithFactory):
>> + """ Test that the delete icons/links for each relevant bug task are
>> + correctly rendered.
>> +
>> + Bug task deletion is protected by a feature flag.
>> + """
>
> The first line may not wrap according to PEP 256.
>

Yeah, sometimes it is hard to limit the text to only one line and still
have it make sense. I'll truncate.

>
> The TestBrowser is an indirect means to test rendering. The view does that.
> you can render any view (that had the principal argument passed) by calling
> it; view(). Launchpad views add striping rules so __call__ calls render().
> You can render a view's templates using view() or view.render(). It is much
> faster than TestBrowser.
>

I only resorted to using TestBrowser because I could get view.render()
to work for this case. It failed with various errors (eg None broken the
chain etc) depending on what I tried. I see you suggest:

 > view = create_initialized_view(
 > bug, name='+bugtasks-and-nominations-table'
 > principal=bugtask.owner)

I tried things like eg:

  view = create_initialized_view(bugtask, name='+index',
     rootsite='bugs', principal=bugtask.owner)

  view = create_initialized_view(bug, name='+index',
     rootsite='bugs', principal=bugtask.owner)

I'd like to understand why view.render() failed.

>
> And I see you did you view.render() here. I do not care for exact testing
> of user text because it tends to change often and get tested more than once.
> I put ids on the text fragment, id="deletion-waring-message", and just test
> for the presence. This permits non technical users to make trivial changes
> to the text while the code ensures that the intent of the message is still
> in the content.
>

Yes, good idea. I had doubts how far we needed to go here, hence the use
of the regex to test the gist of the message.

>
> This code is repeating the mistakes of Bugs past. The code embeds roles
> and celebrities into model code. This is the primary reason bug permissions
> are fucked up. I believe this logic belongs in lp.bugs.security, where I
> think this came from. userCanDelete() could do this:
> def userCanDelete(self):
> return check_permi...

[William Grant (wgrant)]

37 + @property
38 + def confirmation_message(self):
39 + return ('<p>You are about to mark bug %s<br>'
40 + 'as no longer affecting %s.</p>'
41 + '<p>This operation will be permanent and cannot be '
42 + 'undone.</p>'
43 + % (self.context.bug.title,
44 + self.context.target.bugtargetdisplayname))

As Curtis says, this is a security hole. Why is this not done in the template? Also, the operation is not permanent -- it can be undone, by readding the task.

[Ian Booth (wallyworld)]

On 26/10/11 08:36, William Grant wrote:
> 37 + @property
> 38 + def confirmation_message(self):
> 39 + return ('<p>You are about to mark bug %s<br>'
> 40 + 'as no longer affecting %s.</p>'
> 41 + '<p>This operation will be permanent and cannot be '
> 42 + 'undone.</p>'
> 43 + % (self.context.bug.title,
> 44 + self.context.target.bugtargetdisplayname))
>
> As Curtis says, this is a security hole. Why is this not done in the template? Also, the operation is not permanent -- it can be undone, by readding the task.

I'm fixing the hole.
The message is worded as per the bug report. I think the indent is that
in general, deletion is a serious decision and the user must be sure.

[Ian Booth (wallyworld)]

Hi

I've addressed the issues raised. Reverting the security check code to
how it was makes the diff much shorter.

>> @@ -3552,6 +3585,8 @@
>> row_css_class='highlight' if is_primary else None,
>> target_link=canonical_url(self.context.target),
>> target_link_title=self.target_link_title,
>> + user_can_delete=self.user_can_delete_bugtask,
>> + delete_link=link + '/+delete',
>
> While I am certain this link will work, but it is a crafted link we need to
> maintain with extra testing.
> canonical_url(self.context.target, view_name='+delete')
> will raise an exception if the named view is unregistered.
>

I copied what was done in the test for the +editstatus link. I've fixed
that one too.

>
> The TestBrowser is an indirect means to test rendering. The view does that.
> you can render any view (that had the principal argument passed) by calling
> it; view(). Launchpad views add striping rules so __call__ calls render().
> You can render a view's templates using view() or view.render(). It is much
> faster than TestBrowser.
>
> def test_bugtask_delete_icon(self):
> # The bugtask delete icon is rendered correctly for those tasks the
> # user is allowed to delete.
> bug = self.factory.makeBug()
> bugtask = self.factory.makeBugTask(bug=bug)
> with FeatureFixture(DELETE_BUGTASK_ENABLED):
> login_person(bugtask.owner)
> view = create_initialized_view(
> bug, name='+bugtasks-and-nominations-table'
> principal=bugtask.owner)
> content = view.render()
> # bugtask can be deleted because the user owns it.
> delete_icon = find_tag_by_id(
> content, 'bugtask-delete-task%d' % bugtask.id)
> self.assertEqual(url + '/+delete', delete_icon['href'])
> # default_bugtask cannot be deleted.
> delete_icon = find_tag_by_id(
> content, 'bugtask-delete-task%d' % bug.default_bugtask.id)
> self.assertIsNone(delete_icon)
>

I double checked my original work. I tried again using
 > view = create_initialized_view(
 > bug, name='+bugtasks-and-nominations-table'
 > principal=bugtask.ow

and it wouldn't render. I also tried other variations. So I think
TestBrowser is required for this test sadly.

[Ian Booth (wallyworld)]

I figured out how to avoid using TestBrowser. One key step was to shove
the default bugtask into LaunchBag. Then the view for each table row had
to be constructed and rendered separately. Obvious!

>
> The TestBrowser is an indirect means to test rendering. The view does that.
> you can render any view (that had the principal argument passed) by calling
> it; view(). Launchpad views add striping rules so __call__ calls render().
> You can render a view's templates using view() or view.render(). It is much
> faster than TestBrowser.

<new stuff>
             login_person(bugtask.owner)
             getUtility(ILaunchBag).add(bug.default_bugtask)
             view = create_initialized_view(
                 bug, name='+bugtasks-and-nominations-table',
                 principal=bugtask.owner)
             # We render the bug task table rows - there are 2 bug tasks.
             subviews = view.getBugTaskAndNominationViews()
             self.assertEqual(2, len(subviews))
             default_bugtask_contents = subviews[0]()
             bugtask_contents = subviews[1]()
</new stuff>
             # bugtask can be deleted because the user owns it.
             delete_icon = find_tag_by_id(
                 bugtask_contents, 'bugtask-delete-task%d' % bugtask.id)
             delete_url = canonical_url(
                 bugtask, rootsite='bugs', view_name='+delete')
             self.assertEqual(delete_url, delete_icon['href'])
             # default_bugtask cannot be deleted.
             delete_icon = find_tag_by_id(
                 default_bugtask_contents,
                 'bugtask-delete-task%d' % bug.default_bugtask.id)
             self.assertIsNone(delete_icon)

[Curtis Hovey (sinzui)]

Thank you for fixing this Ian. I wish I remembered to my troubled writing tests for bug nominations where I too discovered the misdirection with the LaunchpadBag. While LaunchpadView, and most proper Zope views requires a context (bugtask) and a request passed on __init__, the very old bug and bugtask views did not use that. We might be able to remove the LaunchpadBag hacks if all the views are LaunchpadViews.

This looks good to land.

review: Approve (code)

=== modified file 'lib/lp/app/javascript/activator/assets/skins/sam/activator-skin.css'
--- lib/lp/app/javascript/activator/assets/skins/sam/activator-skin.css	2011-06-29 14:56:15 +0000
+++ lib/lp/app/javascript/activator/assets/skins/sam/activator-skin.css	2011-11-01 00:49:29 +0000
@@ -2,6 +2,7 @@
 
 .yui3-skin-sam button.yui3-activator-act {
     background: url('edit.png') 0 0 no-repeat;
+    vertical-align: middle;
 }
 
 .yui3-skin-sam .yui3-activator-processing button.yui3-activator-act {
 
=== modified file 'lib/lp/bugs/browser/bugtask.py'
--- lib/lp/bugs/browser/bugtask.py	2011-10-31 15:28:28 +0000
+++ lib/lp/bugs/browser/bugtask.py	2011-11-01 00:49:29 +0000
@@ -18,6 +18,7 @@
     'BugTaskBreadcrumb',
     'BugTaskContextMenu',
     'BugTaskCreateQuestionView',
+    'BugTaskDeletionView',
     'BugTaskEditView',
     'BugTaskExpirableListingView',
     'BugTaskListingItem',
@@ -159,6 +160,7 @@
     custom_widget,
     LaunchpadEditFormView,
     LaunchpadFormView,
+    ReturnToReferrerMixin,
     )
 from lp.app.browser.lazrjs import (
     TextAreaEditorWidget,
@@ -1760,6 +1762,24 @@
         self.updateContextFromData(data)
 
 
+class BugTaskDeletionView(ReturnToReferrerMixin, LaunchpadFormView):
+    """Used to delete a bugtask."""
+
+    schema = IBugTask
+    field_names = []
+
+    label = 'Remove bug task'
+    page_title = label
+
+    @action('Delete', name='delete_bugtask')
+    def delete_bugtask_action(self, action, data):
+        bugtask = self.context
+        message = ("This bug no longer affects %s."
+                    % bugtask.target.bugtargetdisplayname)
+        bugtask.delete()
+        self.request.response.addNotification(message)
+
+
 class BugTaskListingView(LaunchpadView):
     """A view designed for displaying bug tasks in lists."""
     # Note that this right now is only used in tests and to render
@@ -3646,7 +3666,9 @@
     def initialize(self):
         super(BugTaskTableRowView, self).initialize()
         link = canonical_url(self.context)
-        task_link = edit_link = link + '/+editstatus'
+        task_link = edit_link = canonical_url(
+                                    self.context, view_name='+editstatus')
+        delete_link = canonical_url(self.context, view_name='+delete')
         can_edit = check_permission('launchpad.Edit', self.context)
         bugtask_id = self.context.id
         launchbag = getUtility(ILaunchBag)
@@ -3668,6 +3690,8 @@
             row_css_class='highlight' if is_primary else None,
             target_link=canonical_url(self.context.target),
             target_link_title=self.target_link_title,
+            user_can_delete=self.user_can_delete_bugtask,
+            delete_link=delete_link,
             user_can_edit_importance=self.context.userCanEditImportance(
                 self.user),
             importance_css_class='importance' + self.context.importance.name,
@@ -3817,6 +3841,16 @@
         """
         return self.context.userCanEditMilestone(self.user)
 
+    @cachedproperty
+    def user_can_delete_bugtask(self):
+        """Can the user delete the bug task?
+
+        If yes, return True, otherwise return False.
+        """
+        bugtask = self.context
+        return (check_permission('launchpad.Delete', bugtask)
+                and bugtask.canBeDeleted())
+
     @property
     def style_for_add_milestone(self):
         if self.context.milestone is None:
 
=== modified file 'lib/lp/bugs/browser/configure.zcml'
--- lib/lp/bugs/browser/configure.zcml	2011-10-03 07:49:31 +0000
+++ lib/lp/bugs/browser/configure.zcml	2011-11-01 00:49:29 +0000
@@ -589,6 +589,12 @@
             template="../templates/bug-edit.pt"
             permission="launchpad.Edit"/>
         <browser:page
+            name="+delete"
+            for="lp.bugs.interfaces.bugtask.IBugTask"
+            class="lp.bugs.browser.bugtask.BugTaskDeletionView"
+            template="../templates/bugtask-delete.pt"
+            permission="launchpad.Delete"/>
+        <browser:page
             name="+secrecy"
             for="lp.bugs.interfaces.bugtask.IBugTask"
             class="lp.bugs.browser.bug.BugSecrecyEditView"
 
=== modified file 'lib/lp/bugs/browser/tests/test_bugtask.py'
--- lib/lp/bugs/browser/tests/test_bugtask.py	2011-10-31 15:28:28 +0000
+++ lib/lp/bugs/browser/tests/test_bugtask.py	2011-11-01 00:49:29 +0000
@@ -36,6 +36,11 @@
     )
 from canonical.launchpad.testing.pages import find_tag_by_id
 from canonical.launchpad.webapp import canonical_url
+from canonical.launchpad.webapp.authorization import clear_cache
+from canonical.launchpad.webapp.interfaces import (
+    ILaunchBag,
+    ILaunchpadRoot,
+    )
 from canonical.launchpad.webapp.servers import LaunchpadTestRequest
 from canonical.testing.layers import (
     DatabaseFunctionalLayer,
@@ -82,6 +87,9 @@
 from lp.testing.views import create_initialized_view
 
 
+DELETE_BUGTASK_ENABLED = {u"disclosure.delete_bugtask.enabled": u"on"}
+
+
 class TestBugTaskView(TestCaseWithFactory):
 
     layer = LaunchpadFunctionalLayer
@@ -617,6 +625,116 @@
         self.assertIn(series.product.displayname, content)
 
 
+class TestBugTaskDeleteLinks(TestCaseWithFactory):
+    """ Test that the delete icons/links are correctly rendered.
+
+        Bug task deletion is protected by a feature flag.
+        """
+
+    layer = DatabaseFunctionalLayer
+
+    def test_cannot_delete_only_bugtask(self):
+        # The last bugtask cannot be deleted.
+        bug = self.factory.makeBug()
+        login_person(bug.owner)
+        view = create_initialized_view(
+            bug, name='+bugtasks-and-nominations-table')
+        row_view = view._getTableRowView(bug.default_bugtask, False, False)
+        self.assertFalse(row_view.user_can_delete_bugtask)
+        del get_property_cache(row_view).user_can_delete_bugtask
+        with FeatureFixture(DELETE_BUGTASK_ENABLED):
+            self.assertFalse(row_view.user_can_delete_bugtask)
+
+    def test_can_delete_bugtask_if_authorised(self):
+        # The bugtask can be deleted if the user if authorised.
+        bug = self.factory.makeBug()
+        bugtask = self.factory.makeBugTask(bug=bug)
+        login_person(bugtask.owner)
+        view = create_initialized_view(
+            bug, name='+bugtasks-and-nominations-table',
+            principal=bugtask.owner)
+        row_view = view._getTableRowView(bugtask, False, False)
+        self.assertFalse(row_view.user_can_delete_bugtask)
+        del get_property_cache(row_view).user_can_delete_bugtask
+        clear_cache()
+        with FeatureFixture(DELETE_BUGTASK_ENABLED):
+            self.assertTrue(row_view.user_can_delete_bugtask)
+
+    def test_bugtask_delete_icon(self):
+        # The bugtask delete icon is rendered correctly for those tasks the
+        # user is allowed to delete.
+        bug = self.factory.makeBug()
+        bugtask_owner = self.factory.makePerson()
+        bugtask = self.factory.makeBugTask(bug=bug, owner=bugtask_owner)
+        with FeatureFixture(DELETE_BUGTASK_ENABLED):
+            login_person(bugtask.owner)
+            getUtility(ILaunchBag).add(bug.default_bugtask)
+            view = create_initialized_view(
+                bug, name='+bugtasks-and-nominations-table',
+                principal=bugtask.owner)
+            # We render the bug task table rows - there are 2 bug tasks.
+            subviews = view.getBugTaskAndNominationViews()
+            self.assertEqual(2, len(subviews))
+            default_bugtask_contents = subviews[0]()
+            bugtask_contents = subviews[1]()
+            # bugtask can be deleted because the user owns it.
+            delete_icon = find_tag_by_id(
+                bugtask_contents, 'bugtask-delete-task%d' % bugtask.id)
+            delete_url = canonical_url(
+                bugtask, rootsite='bugs', view_name='+delete')
+            self.assertEqual(delete_url, delete_icon['href'])
+            # default_bugtask cannot be deleted.
+            delete_icon = find_tag_by_id(
+                default_bugtask_contents,
+                'bugtask-delete-task%d' % bug.default_bugtask.id)
+            self.assertIsNone(delete_icon)
+
+
+class TestBugTaskDeleteView(TestCaseWithFactory):
+    """Test the bug task delete form."""
+
+    layer = DatabaseFunctionalLayer
+
+    def test_delete_view_rendering(self):
+        # Test the view rendering, including confirmation message, cancel url.
+        bug = self.factory.makeBug()
+        bugtask = self.factory.makeBugTask(bug=bug)
+        bug_url = canonical_url(bugtask.bug, rootsite='bugs')
+        # Set up request so that the ReturnToReferrerMixin can correctly
+        # extra the referer url.
+        server_url = canonical_url(
+            getUtility(ILaunchpadRoot), rootsite='bugs')
+        extra = {'HTTP_REFERER': bug_url}
+        with FeatureFixture(DELETE_BUGTASK_ENABLED):
+            login_person(bugtask.owner)
+            view = create_initialized_view(
+                bugtask, name='+delete', principal=bugtask.owner,
+                server_url=server_url, **extra)
+            contents = view.render()
+            confirmation_message = find_tag_by_id(
+                contents, 'confirmation-message')
+            self.assertIsNotNone(confirmation_message)
+            self.assertEqual(bug_url, view.cancel_url)
+
+    def test_delete_action(self):
+        # Test that the delete action works as expected.
+        bug = self.factory.makeBug()
+        bugtask = self.factory.makeBugTask(bug=bug)
+        target_name = bugtask.bugtargetdisplayname
+        with FeatureFixture(DELETE_BUGTASK_ENABLED):
+            login_person(bugtask.owner)
+            form = {
+                'field.actions.delete_bugtask': 'Delete',
+                }
+            view = create_initialized_view(
+                bugtask, name='+delete', form=form, principal=bugtask.owner)
+            self.assertEqual([bug.default_bugtask], bug.bugtasks)
+            notifications = view.request.response.notifications
+            self.assertEqual(1, len(notifications))
+            expected = 'This bug no longer affects %s.' % target_name
+            self.assertEqual(expected, notifications[0].message)
+
+
 class TestBugTasksAndNominationsViewAlsoAffects(TestCaseWithFactory):
     """ Tests the boolean methods on the view used to indicate whether the
         Also Affects... links should be allowed or not. Currently these
 
=== modified file 'lib/lp/bugs/configure.zcml'
--- lib/lp/bugs/configure.zcml	2011-10-25 02:12:44 +0000
+++ lib/lp/bugs/configure.zcml	2011-11-01 00:49:29 +0000
@@ -194,6 +194,7 @@
                     task_age
                     bug_subscribers
                     is_complete
+                    canBeDeleted
                     canTransitionToStatus
                     isSubscribed
                     getPackageComponent
 
=== added file 'lib/lp/bugs/templates/bugtask-delete.pt'
--- lib/lp/bugs/templates/bugtask-delete.pt	1970-01-01 00:00:00 +0000
+++ lib/lp/bugs/templates/bugtask-delete.pt	2011-11-01 00:49:29 +0000
@@ -0,0 +1,26 @@
+<html
+  xmlns="http://www.w3.org/1999/xhtml"
+  xmlns:tal="http://xml.zope.org/namespaces/tal"
+  xmlns:metal="http://xml.zope.org/namespaces/metal"
+  xmlns:i18n="http://xml.zope.org/namespaces/i18n"
+  metal:use-macro="view/macro:page/main_only"
+  i18n:domain="launchpad">
+<body>
+
+<div metal:fill-slot="main">
+  <div metal:use-macro="context/@@launchpad_form/form">
+    <div id='confirmation-message' metal:fill-slot="extra_info">
+        <p class="large-warning" style="padding:2px 2px 0 36px;">
+            You are about to mark bug
+            "<tal:bug replace="context/bug/title">some bug</tal:bug>"
+            <br>as no longer affecting
+            <tal:target
+                replace="context/target/bugtargetdisplayname">some target
+            </tal:target>.
+        <br><br>
+        <strong>Please confirm you really want to do this.</strong></p>
+    </div>
+  </div>
+</div>
+</body>
+</html>
 
=== modified file 'lib/lp/bugs/templates/bugtask-tasks-and-nominations-table-row.pt'
--- lib/lp/bugs/templates/bugtask-tasks-and-nominations-table-row.pt	2011-08-19 08:55:04 +0000
+++ lib/lp/bugs/templates/bugtask-tasks-and-nominations-table-row.pt	2011-11-01 00:49:29 +0000
@@ -18,6 +18,11 @@
           tal:content="view/getSeriesTargetName"
         />
       </tal:not-conjoined-task>
+        <a tal:condition="data/user_can_delete"
+           tal:attributes="
+            id string:bugtask-delete-${data/form_row_id};
+            href data/delete_link"
+           class="sprite remove bugtask-delete" style="margin-left: 4px"></a>
     </td>
     <td tal:condition="not:data/indent_task">
       <span tal:attributes="id string:bugtarget-picker-${data/row_id}">
@@ -33,6 +38,11 @@
           Edit
         </button>
         <div class="yui3-activator-message-box yui3-activator-hidden"></div>
+        <a tal:condition="data/user_can_delete"
+           tal:attributes="
+            id string:bugtask-delete-${data/form_row_id};
+            href data/delete_link"
+           class="sprite remove bugtask-delete" style="margin-left: 4px"></a>
       </span>
     </td>
 
 
=== modified file 'lib/lp/testing/views.py'
--- lib/lp/testing/views.py	2011-10-31 04:46:01 +0000
+++ lib/lp/testing/views.py	2011-11-01 00:49:29 +0000
@@ -82,7 +82,7 @@
                             server_url=None, method=None, principal=None,
                             query_string=None, cookie=None, request=None,
                             path_info='/', rootsite=None,
-                            current_request=False):
+                            current_request=False, **kwargs):
     """Return a view that has already been initialized."""
     if method is None:
         if form is None:
@@ -92,7 +92,7 @@
     view = create_view(
         context, name, form, layer, server_url, method, principal,
         query_string, cookie, request, path_info, rootsite=rootsite,
-        current_request=current_request)
+        current_request=current_request, **kwargs)
     view.initialize()
     return view