Importers need it for project update. Introduce and use
Project.properties_visible() method to fix the permission problem.

Signed-off-by: Fam Zheng <famz@redhat.com>
---
 api/models.py | 4 ++++
 api/views.py  | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/api/models.py b/api/models.py
index a672bd4..955a91c 100644
--- a/api/models.py
+++ b/api/models.py
@@ -134,6 +134,10 @@ class Project(models.Model):
             return True
         return False
 
+    def properties_visible(self, user):
+        return self.maintained_by(user) or \
+               user.groups.filter(name='importers').exists()
+
     def recognizes(self, m):
         """Test if @m is considered a message in this project"""
         addr_ok = False
diff --git a/api/views.py b/api/views.py
index 2d84be8..122a4d9 100644
--- a/api/views.py
+++ b/api/views.py
@@ -85,7 +85,7 @@ class ListProjectView(APIView):
                 "git": p.git,
                 "description": p.description,
             }
-            if p.maintained_by(request.user):
+            if p.properties_visible(request.user):
                 ret["properties"] = p.get_properties()
             return ret
 
@@ -111,7 +111,7 @@ class GetProjectPropertiesView(APIView):
 
     def handle(self, request, project):
         po = Project.objects.get(name=project)
-        if not po.maintained_by(request.user):
+        if not po.properties_visible(request.user):
             raise PermissionDenied("Access denied to this project")
         return po.get_properties()
 
-- 
2.14.3

_______________________________________________
Patchew-devel mailing list
Patchew-devel@redhat.com
https://www.redhat.com/mailman/listinfo/patchew-devel

On 27/03/2018 20:17, Fam Zheng wrote:
> Importers need it for project update. Introduce and use
> Project.properties_visible() method to fix the permission problem.
> 
> Signed-off-by: Fam Zheng <famz@redhat.com>

Maybe even revert the original patch that caused the problem.  It's not
any worse than on patchew.org, and with ssh key support we can make
properties public with no worries.

Paolo

_______________________________________________
Patchew-devel mailing list
Patchew-devel@redhat.com
https://www.redhat.com/mailman/listinfo/patchew-devel

On Tue, 03/27 22:15, Paolo Bonzini wrote:
> On 27/03/2018 20:17, Fam Zheng wrote:
> > Importers need it for project update. Introduce and use
> > Project.properties_visible() method to fix the permission problem.
> > 
> > Signed-off-by: Fam Zheng <famz@redhat.com>
> 
> Maybe even revert the original patch that caused the problem.  It's not
> any worse than on patchew.org, and with ssh key support we can make
> properties public with no worries.

Yes. It sounds good.

Fam

_______________________________________________
Patchew-devel mailing list
Patchew-devel@redhat.com
https://www.redhat.com/mailman/listinfo/patchew-devel