diff --git a/src/main/scala/app/IssuesController.scala b/src/main/scala/app/IssuesController.scala index 5cc89a8..c8a1dbd 100644 --- a/src/main/scala/app/IssuesController.scala +++ b/src/main/scala/app/IssuesController.scala @@ -65,11 +65,12 @@ (getCollaborators(owner, repository) :+ owner).sorted, getMilestones(owner, repository), getLabels(owner, repository), + hasWritePermission(owner, repository, context.loginAccount), getRepository(owner, repository, baseUrl).get) } getOrElse NotFound }) - get("/:owner/:repository/issues/new")( readableUsersOnly { + get("/:owner/:repository/issues/new")(readableUsersOnly { val owner = params("owner") val repository = params("repository") @@ -82,20 +83,22 @@ } getOrElse NotFound }) - post("/:owner/:repository/issues/new", issueCreateForm)( readableUsersOnly { form => - val owner = params("owner") + post("/:owner/:repository/issues/new", issueCreateForm)(readableUsersOnly { form => + val owner = params("owner") val repository = params("repository") + val writable = hasWritePermission(owner, repository, context.loginAccount) - // TODO User and milestone are assigned by only collaborators. - val issueId = createIssue(owner, repository, context.loginAccount.get.userName, - form.title, form.content, form.assignedUserName, form.milestoneId) + val issueId = createIssue(owner, repository, context.loginAccount.get.userName, form.title, form.content, + if(writable) form.assignedUserName else None, + if(writable) form.milestoneId else None) - // TODO labels are assigned by only collaborators - form.labelNames.map { value => - val labels = getLabels(owner, repository) - value.split(",").foreach { labelName => - labels.find(_.labelName == labelName).map { label => - registerIssueLabel(owner, repository, issueId, label.labelId) + if(writable){ + form.labelNames.map { value => + val labels = getLabels(owner, repository) + value.split(",").foreach { labelName => + labels.find(_.labelName == labelName).map { label => + registerIssueLabel(owner, repository, issueId, label.labelId) + } } } } @@ -103,18 +106,24 @@ redirect("/%s/%s/issues/%d".format(owner, repository, issueId)) }) - // TODO Authenticator - ajaxPost("/:owner/:repository/issues/edit/:id", issueEditForm){ form => - val owner = params("owner") + ajaxPost("/:owner/:repository/issues/edit/:id", issueEditForm)(readableUsersOnly { form => + val owner = params("owner") val repository = params("repository") - val issueId = params("id").toInt + val issueId = params("id").toInt + val writable = hasWritePermission(owner, repository, context.loginAccount) - updateIssue(owner, repository, issueId, form.title, form.content) - redirect("/%s/%s/issues/_data/%d".format(owner, repository, issueId)) - } + getIssue(owner, repository, issueId.toString).map { issue => + if(writable || issue.openedUserName == context.loginAccount.get.userName){ + updateIssue(owner, repository, issueId, form.title, form.content) + redirect("/%s/%s/issues/_data/%d".format(owner, repository, issueId)) + } else { + Unauthorized + } + } getOrElse NotFound + }) - // TODO requires users only and readable repository checking - post("/:owner/:repository/issue_comments/new", commentForm)( referrersOnly { form => + // TODO repository checking + post("/:owner/:repository/issue_comments/new", commentForm)(readableUsersOnly { form => val owner = params("owner") val repository = params("repository") val action = params.get("action") filter { action => @@ -125,13 +134,22 @@ createComment(owner, repository, context.loginAccount.get.userName, form.issueId, form.content, action))) }) - // TODO Authenticator, repository checking - ajaxPost("/:owner/:repository/issue_comments/edit/:id", commentForm){ form => - val commentId = params("id").toInt + // TODO repository checking + ajaxPost("/:owner/:repository/issue_comments/edit/:id", commentForm)(readableUsersOnly { form => + val owner = params("owner") + val repository = params("repository") + val commentId = params("id").toInt + val writable = hasWritePermission(owner, repository, context.loginAccount) - updateComment(commentId, form.content) - redirect("/%s/%s/issue_comments/_data/%d".format(params("owner"), params("repository"), commentId)) - } + getComment(commentId.toString).map { comment => + if(writable || comment.commentedUserName == context.loginAccount.get.userName){ + updateComment(commentId, form.content) + redirect("/%s/%s/issue_comments/_data/%d".format(owner, repository, commentId)) + } else { + Unauthorized + } + } getOrElse NotFound + }) // TODO Authenticator ajaxGet("/:owner/:repository/issues/_data/:id"){ diff --git a/src/main/twirl/issues/issue.scala.html b/src/main/twirl/issues/issue.scala.html index 8838305..e5551d2 100644 --- a/src/main/twirl/issues/issue.scala.html +++ b/src/main/twirl/issues/issue.scala.html @@ -4,6 +4,7 @@ collaborators: List[String], milestones: List[model.Milestone], labels: List[model.Label], + hasWritePermission: Boolean, repository: service.RepositoryService.RepositoryInfo)(implicit context: app.Context) @import context._ @import view.helpers._ @@ -19,7 +20,9 @@
- Edit + @if(hasWritePermission || loginAccount.map(_.userName == issue.openedUserName).getOrElse(false)){ + Edit + }
@issue.openedUserName opened this issue @datetime(issue.registeredDate)
@@ -31,11 +34,13 @@ @userName is assigned }.getOrElse("No one is assigned") - @helper.html.dropdown { -
  • Clear assignee
    • -
  • - @collaborators.map { collaborator => -
  • @collaborator
    • + @if(hasWritePermission){ + @helper.html.dropdown { +
  • Clear assignee
    • +
  • + @collaborators.map { collaborator => +
  • @collaborator
    • + } } }
    @@ -46,11 +51,13 @@ } }.getOrElse("No milestone") - @helper.html.dropdown { -
  • No milestone
    • -
  • - @milestones.map { milestone => -
  • @milestone.title
    • + @if(hasWritePermission){ + @helper.html.dropdown { +
  • No milestone
    • +
  • + @milestones.map { milestone => +
  • @milestone.title
    • + } } }
    @@ -61,40 +68,44 @@
    @comments.map { comment => -
    -
    - @comment.commentedUserName commented - - @datetime(comment.registeredDate) - - +
    +
    + @comment.commentedUserName commented + + @datetime(comment.registeredDate) + @if(hasWritePermission || loginAccount.map(_.userName == comment.commentedUserName).getOrElse(false)){ + + } + +
    +
    + @markdown(comment.content, repository, false, true, true) +
    -
    - @markdown(comment.content, repository, false, true, true) + @comment.action.map { action => +
    + @if(action == "close"){ + Closed + @comment.commentedUserName closed the issue @datetime(comment.registeredDate) + } else { + Reopened + @comment.commentedUserName reopened the issue @datetime(comment.registeredDate) + }
    -
    - @comment.action.map { action => -
    - @if(action == "close"){ - Closed - @comment.commentedUserName closed the issue @datetime(comment.registeredDate) - } else { - Reopened - @comment.commentedUserName reopened the issue @datetime(comment.registeredDate) } -
    } + @if(loginAccount.isDefined){ +
    +
    +
    + @helper.html.preview(repository, "", false, true, true, "width: 730px; height: 100px;") +
    +
    + + + +
    } -
    -
    -
    - @helper.html.preview(repository, "", false, true, true, "width: 730px; height: 100px;") -
    -
    - - - -
    @if(issue.closed) { @@ -105,25 +116,27 @@
    @comments.size comments
    Labels -
    -
    - - + @if(hasWritePermission){ +
    +
    + + +
    -
    + }
      @labellist(issueLabels)
    diff --git a/src/main/twirl/issues/tab.scala.html b/src/main/twirl/issues/tab.scala.html index f78d5c5..de340e6 100644 --- a/src/main/twirl/issues/tab.scala.html +++ b/src/main/twirl/issues/tab.scala.html @@ -4,9 +4,11 @@