vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix some bugs with the permissions API. Prevent the user from removing themelves as admin.

Browse source
This commit is contained in:
yackob03 2013-09-27 15:53:39 -04:00
parent 479e23b09d
commit 53f2a31547
2 changed files with 54 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

20
endpoints/api.py
View file

@ -153,8 +153,7 @@ def get_permissions(namespace, repository, username):
(namespace, repository, username))
permission = AdministerRepositoryPermission(namespace, repository)
if permission.can():
user = current_user.db_user
perm = model.get_user_reponame_permission(user, namespace, repository)
perm = model.get_user_reponame_permission(username, namespace, repository)
return jsonify(role_view(perm))
abort(403) # Permission denied
@ -169,11 +168,15 @@ def change_permissions(namespace, repository, username):
if permission.can():
new_permission = request.get_json()
user = current_user.db_user
logger.debug('Setting permission to: %s for user %s' %
(new_permission['role'], username))
perm = model.set_user_repo_permission(user, namespace, repository,
new_permission['role'])
try:
perm = model.set_user_repo_permission(username, namespace, repository,
new_permission['role'])
except model.DataModelException:
logger.warning('User tried to remove themselves as admin.')
abort(409)
resp = jsonify(role_view(perm))
if request.method == 'POST':
@ -189,7 +192,12 @@ def change_permissions(namespace, repository, username):
def delete_permissions(namespace, repository, username):
permission = AdministerRepositoryPermission(namespace, repository)
if permission.can():
model.delete_user_permission(current_user.db_user, namespace, repository)
try:
model.delete_user_permission(username, namespace, repository)
except model.DataModelException:
logger.warning('User tried to remove themselves as admin.')
abort(409)
return make_response('Deleted', 204)
abort(403) # Permission denied