Skip to content

Commit 44a120e

Browse files
zeripathzeripath
committed
Properly handle permissions in the UI and avoid the permissions map
We can avoid the permissions map because the dependencies are ordered by repoid when they are extracted from the db. Signed-off-by: Andrew Thornton <art27@cantab.net>
1 parent d075ffd commit 44a120e

File tree

4 files changed

+124
-24
lines changed

4 files changed

+124
-24
lines changed

‎options/locale/locale_en-US.ini‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1488,6 +1488,9 @@ issues.due_date_invalid = "The due date is invalid or out of range. Please use t
14881488
issues.dependency.title = Dependencies
14891489
issues.dependency.issue_no_dependencies = No dependencies set.
14901490
issues.dependency.pr_no_dependencies = No dependencies set.
1491+
issues.dependency.no_permission_1 = "You do not have permission to read %d dependency"
1492+
issues.dependency.no_permission_n = "You do not have permission to read %d dependencies"
1493+
issues.dependency.no_permission.can_remove = "You do not have permission to read this dependency but can remove this dependency"
14911494
issues.dependency.add = Add dependency…
14921495
issues.dependency.cancel = Cancel
14931496
issues.dependency.remove = Remove

‎routers/api/v1/repo/issue_dependency.go‎

Lines changed: 31 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,6 @@ func GetIssueDependencies(ctx *context.APIContext) {
9090

9191
blockerIssues := make([]*issues_model.Issue, 0, limit)
9292

93-
perms := map[int64]access_model.Permission{}
94-
perms[ctx.Repo.Repository.ID] = ctx.Repo.Permission
95-
9693
// 2. Get the issues this issue depends on, i.e. the `<#b>`: `<issue> <- <#b>`
9794
blockersInfo, err := issue.BlockedByDependencies(ctx, db.ListOptions{
9895
Page: page,
@@ -102,16 +99,24 @@ func GetIssueDependencies(ctx *context.APIContext) {
10299
ctx.Error(http.StatusInternalServerError, "BlockedByDependencies", err)
103100
return
104101
}
105-
for _, blocker := range blockersInfo {
106102

103+
var lastRepoID int64
104+
var lastPerm access_model.Permission
105+
for _, blocker := range blockersInfo {
107106
// Get the permissions for this repository
108-
perm, has := perms[blocker.Repository.ID]
109-
if !has {
110-
perm, err = access_model.GetUserRepoPermission(ctx, &blocker.Repository, ctx.Doer)
111-
if err != nil {
112-
ctx.Error(http.StatusInternalServerError, "GetUserRepoPermission", err)
113-
return
107+
perm := lastPerm
108+
if lastRepoID != blocker.Repository.ID {
109+
if blocker.Repository.ID == ctx.Repo.Repository.ID {
110+
perm = ctx.Repo.Permission
111+
} else {
112+
var err error
113+
perm, err = access_model.GetUserRepoPermission(ctx, &blocker.Repository, ctx.Doer)
114+
if err != nil {
115+
ctx.ServerError("GetUserRepoPermission", err)
116+
return
117+
}
114118
}
119+
lastRepoID = blocker.Repository.ID
115120
}
116121

117122
// check permission
@@ -330,22 +335,29 @@ func GetIssueBlocks(ctx *context.APIContext) {
330335
return
331336
}
332337

333-
permMap := map[int64]access_model.Permission{}
334-
permMap[ctx.Repo.Repository.ID] = ctx.Repo.Permission
338+
var lastRepoID int64
339+
var lastPerm access_model.Permission
340+
335341
var issues []*issues_model.Issue
336342
for i, depMeta := range deps {
337343
if i < skip || i >= max {
338344
continue
339345
}
340346

341-
perm, has := permMap[depMeta.Repository.ID]
342-
if !has {
343-
perm, err = access_model.GetUserRepoPermission(ctx, &depMeta.Repository, ctx.Doer)
344-
if err != nil {
345-
ctx.Error(http.StatusInternalServerError, "GetUserRepoPermission", err)
346-
return
347+
// Get the permissions for this repository
348+
perm := lastPerm
349+
if lastRepoID != depMeta.Repository.ID {
350+
if depMeta.Repository.ID == ctx.Repo.Repository.ID {
351+
perm = ctx.Repo.Permission
352+
} else {
353+
var err error
354+
perm, err = access_model.GetUserRepoPermission(ctx, &depMeta.Repository, ctx.Doer)
355+
if err != nil {
356+
ctx.ServerError("GetUserRepoPermission", err)
357+
return
358+
}
347359
}
348-
permMap[depMeta.Repository.ID] = perm
360+
lastRepoID = depMeta.Repository.ID
349361
}
350362

351363
if !perm.CanReadIssuesOrPulls(depMeta.Issue.IsPull) {

‎routers/web/repo/issue.go‎

Lines changed: 54 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1812,17 +1812,27 @@ func ViewIssue(ctx *context.Context) {
18121812
}
18131813

18141814
// Get Dependencies
1815-
ctx.Data["BlockedByDependencies"], err = issue.BlockedByDependencies(ctx, db.ListOptions{})
1815+
blockedBy, err := issue.BlockedByDependencies(ctx, db.ListOptions{})
18161816
if err != nil {
18171817
ctx.ServerError("BlockedByDependencies", err)
18181818
return
18191819
}
1820-
ctx.Data["BlockingDependencies"], err = issue.BlockingDependencies(ctx)
1820+
ctx.Data["BlockedByDependencies"], ctx.Data["BlockedByDependenciesNotPermitted"] = checkBlockedByIssues(ctx, blockedBy)
1821+
if ctx.Written() {
1822+
return
1823+
}
1824+
1825+
blocking, err := issue.BlockingDependencies(ctx)
18211826
if err != nil {
18221827
ctx.ServerError("BlockingDependencies", err)
18231828
return
18241829
}
18251830

1831+
ctx.Data["BlockingDependencies"], ctx.Data["BlockingByDependenciesNotPermitted"] = checkBlockedByIssues(ctx, blocking)
1832+
if ctx.Written() {
1833+
return
1834+
}
1835+
18261836
ctx.Data["Participants"] = participants
18271837
ctx.Data["NumParticipants"] = len(participants)
18281838
ctx.Data["Issue"] = issue
@@ -1851,6 +1861,48 @@ func ViewIssue(ctx *context.Context) {
18511861
ctx.HTML(http.StatusOK, tplIssueView)
18521862
}
18531863

1864+
func checkBlockedByIssues(ctx *context.Context, blockers []*issues_model.DependencyInfo) (canRead, notPermitted []*issues_model.DependencyInfo) {
1865+
var lastRepoID int64
1866+
var lastPerm access_model.Permission
1867+
for i, blocker := range blockers {
1868+
// Get the permissions for this repository
1869+
perm := lastPerm
1870+
if lastRepoID != blocker.Repository.ID {
1871+
if blocker.Repository.ID == ctx.Repo.Repository.ID {
1872+
perm = ctx.Repo.Permission
1873+
} else {
1874+
var err error
1875+
perm, err = access_model.GetUserRepoPermission(ctx, &blocker.Repository, ctx.Doer)
1876+
if err != nil {
1877+
ctx.ServerError("GetUserRepoPermission", err)
1878+
return
1879+
}
1880+
}
1881+
lastRepoID = blocker.Repository.ID
1882+
}
1883+
1884+
// check permission
1885+
if !perm.CanReadIssuesOrPulls(blocker.Issue.IsPull) {
1886+
blockers[len(notPermitted)], blockers[i] = blocker, blockers[len(notPermitted)]
1887+
notPermitted = blockers[:len(notPermitted)+1]
1888+
}
1889+
}
1890+
blockers = blockers[len(notPermitted):]
1891+
sortDependencyInfo(blockers)
1892+
sortDependencyInfo(notPermitted)
1893+
1894+
return blockers, notPermitted
1895+
}
1896+
1897+
func sortDependencyInfo(blockers []*issues_model.DependencyInfo) {
1898+
sort.Slice(blockers, func(i, j int) bool {
1899+
if blockers[i].RepoID == blockers[j].RepoID {
1900+
return blockers[i].Issue.CreatedUnix < blockers[j].Issue.CreatedUnix
1901+
}
1902+
return blockers[i].RepoID < blockers[j].RepoID
1903+
})
1904+
}
1905+
18541906
// GetActionIssue will return the issue which is used in the context.
18551907
func GetActionIssue(ctx *context.Context) *issues_model.Issue {
18561908
issue, err := issues_model.GetIssueByIndex(ctx.Repo.Repository.ID, ctx.ParamsInt64(":index"))

‎templates/repo/issue/view_content/sidebar.tmpl‎

Lines changed: 36 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -420,7 +420,7 @@
420420
<div class="ui divider"></div>
421421

422422
<div class="ui depending">
423-
{{if (and (not .BlockedByDependencies) (not .BlockingDependencies))}}
423+
{{if (and (not .BlockedByDependencies) (not .BlockedByDependenciesNotPermitted) (not .BlockingDependencies) (not .BlockingDependenciesNotPermitted))}}
424424
<span class="text"><strong>{{.locale.Tr "repo.issues.dependency.title"}}</strong></span>
425425
<br>
426426
<p>
@@ -432,7 +432,7 @@
432432
</p>
433433
{{end}}
434434

435-
{{if .BlockingDependencies}}
435+
{{if or .BlockingDependencies .BlockingDependenciesNotPermitted}}
436436
<span class="text" data-tooltip-content="{{if .Issue.IsPull}}{{.locale.Tr "repo.issues.dependency.pr_close_blocks"}}{{else}}{{.locale.Tr "repo.issues.dependency.issue_close_blocks"}}{{end}}">
437437
<strong>{{.locale.Tr "repo.issues.dependency.blocks_short"}}</strong>
438438
</span>
@@ -456,10 +456,15 @@
456456
</div>
457457
</div>
458458
{{end}}
459+
{{if .BlockingDependenciesNotPermitted}}
460+
<div class="item gt-df gt-ac gt-sb">
461+
<span>{{$.locale.TrN (len .BlockingDependenciesNotPermitted) "repo.issues.dependency.no_permission_1" "repo.issues.dependency.no_permission_n" (len .BlockingDependenciesNotPermitted)}}</span>
462+
</div>
463+
{{end}}
459464
</div>
460465
{{end}}
461466

462-
{{if .BlockedByDependencies}}
467+
{{if or .BlockedByDependencies .BlockedByDependenciesNotPermitted}}
463468
<span class="text" data-tooltip-content="{{if .Issue.IsPull}}{{.locale.Tr "repo.issues.dependency.pr_closing_blockedby"}}{{else}}{{.locale.Tr "repo.issues.dependency.issue_closing_blockedby"}}{{end}}">
464469
<strong>{{.locale.Tr "repo.issues.dependency.blocked_by_short"}}</strong>
465470
</span>
@@ -483,6 +488,34 @@
483488
</div>
484489
</div>
485490
{{end}}
491+
{{if $.CanCreateIssueDependencies}}
492+
{{range .BlockedByDependenciesNotPermitted}}
493+
<div class="item dependency{{if .Issue.IsClosed}} is-closed{{end}} gt-df gt-ac gt-sb">
494+
<div class="item-left gt-df gt-jc gt-fc gt-f1">
495+
<div>
496+
<span data-tooltip-content="{{$.locale.Tr "repo.issues.dependency.no_permission.can_remove"}}">{{svg "octicon-lock" 16}}</span>
497+
<span class="title" data-tooltip-content="#{{.Issue.Index}} {{.Issue.Title | RenderEmoji $.Context}}">
498+
#{{.Issue.Index}} {{.Issue.Title | RenderEmoji $.Context}}
499+
</span>
500+
</div>
501+
<div class="text small">
502+
{{.Repository.OwnerName}}/{{.Repository.Name}}
503+
</div>
504+
</div>
505+
<div class="item-right gt-df gt-ac">
506+
{{if and $.CanCreateIssueDependencies (not $.Repository.IsArchived)}}
507+
<a class="delete-dependency-button ci muted" data-id="{{.Issue.ID}}" data-type="blocking" data-tooltip-content="{{$.locale.Tr "repo.issues.dependency.remove_info"}}">
508+
{{svg "octicon-trash" 16}}
509+
</a>
510+
{{end}}
511+
</div>
512+
</div>
513+
{{end}}
514+
{{else if .BlockedByDependenciesNotPermitted}}
515+
<div class="item gt-df gt-ac gt-sb">
516+
<span>{{$.locale.TrN (len .BlockedByDependenciesNotPermitted) "repo.issues.dependency.no_permission_1" "repo.issues.dependency.no_permission_n" (len .BlockedByDependenciesNotPermitted)}}</span>
517+
</div>
518+
{{end}}
486519
</div>
487520
{{end}}
488521

0 commit comments

Comments
 (0)