permissions: fixed problem with permissions changes from permission page

rhodecode/apps/repository/views/repo_permissions.py

@@ -1,135 +1,140 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2020 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 
 from pyramid.httpexceptions import HTTPFound
 from pyramid.view import view_config
 
 from rhodecode.apps._base import RepoAppView
 from rhodecode.lib import helpers as h
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired)
 from rhodecode.lib.utils2 import str2bool
 from rhodecode.model.db import User
 from rhodecode.model.forms import RepoPermsForm
 from rhodecode.model.meta import Session
 from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 
 log = logging.getLogger(__name__)
 
 
 class RepoSettingsPermissionsView(RepoAppView):
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
         return c
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @view_config(
         route_name='edit_repo_perms', request_method='GET',
         renderer='rhodecode:templates/admin/repos/repo_edit.mako')
     def edit_permissions(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'permissions'
         if self.request.GET.get('branch_permissions'):
             h.flash(_('Explicitly add user or user group with write+ '
                       'permission to modify their branch permissions.'),
                     category='notice')
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @CSRFRequired()
     @view_config(
         route_name='edit_repo_perms', request_method='POST',
         renderer='rhodecode:templates/admin/repos/repo_edit.mako')
     def edit_permissions_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'permissions'
         data = self.request.POST
         # store private flag outside of HTML to verify if we can modify
         # default user permissions, prevents submission of FAKE post data
         # into the form for private repos
         data['repo_private'] = self.db_repo.private
         form = RepoPermsForm(self.request.translate)().to_python(data)
         changes = RepoModel().update_permissions(
             self.db_repo_name, form['perm_additions'], form['perm_updates'],
             form['perm_deletions'])
 
         action_data = {
             'added': changes['added'],
             'updated': changes['updated'],
             'deleted': changes['deleted'],
         }
         audit_logger.store_web(
             'repo.edit.permissions', action_data=action_data,
             user=self._rhodecode_user, repo=self.db_repo)
 
         Session().commit()
         h.flash(_('Repository access permissions updated'), category='success')
 
         affected_user_ids = None
         if changes.get('default_user_changed', False):
             # if we change the default user, we need to flush everyone permissions
             affected_user_ids = User.get_all_user_ids()
         PermissionModel().flush_user_permission_caches(
             changes, affected_user_ids=affected_user_ids)
 
         raise HTTPFound(
             h.route_path('edit_repo_perms', repo_name=self.db_repo_name))
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @CSRFRequired()
     @view_config(
         route_name='edit_repo_perms_set_private', request_method='POST',
         renderer='json_ext')
     def edit_permissions_set_private_repo(self):
         _ = self.request.translate
         self.load_default_context()
 
         private_flag = str2bool(self.request.POST.get('private'))
 
         try:
-            RepoModel().update(
-                self.db_repo, **{'repo_private': private_flag, 'repo_name': self.db_repo_name})
+            repo = RepoModel().get(self.db_repo.repo_id)
+            repo.private = private_flag
+            Session().add(repo)
+            RepoModel().grant_user_permission(
+                repo=self.db_repo, user=User.DEFAULT_USER, perm='repository.none'
+            )
+
             Session().commit()
 
             h.flash(_('Repository `{}` private mode set successfully').format(self.db_repo_name),
                     category='success')
+            # NOTE(dan): we change repo private mode we need to notify all USERS
+            affected_user_ids = User.get_all_user_ids()
+            PermissionModel().trigger_permission_flush(affected_user_ids)
+
         except Exception:
             log.exception("Exception during update of repository")
             h.flash(_('Error occurred during update of repository {}').format(
                 self.db_repo_name), category='error')
 
-        # NOTE(dan): we change repo private mode we need to notify all USERS
-        affected_user_ids = User.get_all_user_ids()
-        PermissionModel().trigger_permission_flush(affected_user_ids)
-
         return {
             'redirect_url': h.route_path('edit_repo_perms', repo_name=self.db_repo_name),
             'private': private_flag
         }

rhodecode/templates/admin/repos/repo_edit_permissions.mako

@@ -1,232 +1,239 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Repository Access Permissions')}</h3>
     </div>
     <div class="panel-body">
         ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>
                 <th class="td-radio">${_('Read')}</th>
                 <th class="td-radio">${_('Write')}</th>
                 <th class="td-radio">${_('Admin')}</th>
                 <th class="td-owner">${_('User/User Group')}</th>
                 <th class="td-action"></th>
                 <th class="td-action"></th>
             </tr>
             ## USERS
             %for _user in c.rhodecode_db_repo.permissions():
                 %if getattr(_user, 'admin_row', None) or getattr(_user, 'owner_row', None):
                     <tr class="perm_admin_row">
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.admin', 'repository.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16, user=_user, tooltip=True)}
                             ${h.link_to_user(_user.username)}
                             %if getattr(_user, 'admin_row', None):
                                 (${_('super-admin')})
                             %endif
                             %if getattr(_user, 'owner_row', None):
                                 (${_('owner')})
                             %endif
                         </td>
                         <td></td>
                         <td class="quick_repo_menu">
                             % if c.rhodecode_user.is_admin:
                                 <i class="icon-more"></i>
                                 <div class="menu_items_container" style="display: none;">
                                 <ul class="menu_items">
                                   <li>
                                      ${h.link_to('show permissions', h.route_path('edit_user_perms_summary', user_id=_user.user_id, _anchor='repositories-permissions'))}
                                   </li>
                                 </ul>
                                 </div>
                             % endif
                         </td>
                     </tr>
                 %elif _user.username == h.DEFAULT_USER and c.rhodecode_db_repo.private:
                     <tr>
                         <td colspan="4">
                             <span class="private_repo_msg">
                             <strong title="${h.tooltip(_user.permission)}">${_('private repository')}</strong>
                             </span>
                         </td>
                         <td class="private_repo_msg">
                             ${base.gravatar(h.DEFAULT_USER_EMAIL, 16)}
                             ${h.DEFAULT_USER} - ${_('only users/user groups explicitly added here will have access')}</td>
                         <td class="td-action">
-                            <span class="tooltip btn btn-link btn-default" onclick="setPrivateRepo(false); return false" title="${_('Private repositories are only visible to people explicitly added as collaborators. Default permissions wont apply')}">
+                            <span class="noselect tooltip btn btn-link btn-default" onclick="setPrivateRepo(this, false); return false" title="${_('Private repositories are only visible to people explicitly added as collaborators. Default permissions wont apply')}">
                             ${_('un-set private mode')}
                             </span>
                         </td>
                         <td class="quick_repo_menu">
                             % if c.rhodecode_user.is_admin:
                                 <i class="icon-more"></i>
                                 <div class="menu_items_container" style="display: none;">
                                 <ul class="menu_items">
                                   <li>
                                      ${h.link_to('show permissions', h.route_path('admin_permissions_overview', _anchor='repositories-permissions'))}
                                   </li>
                                 </ul>
                                 </div>
                             % endif
                         </td>
                     </tr>
                 %else:
                     <% used_by_n_rules = len(getattr(_user, 'branch_rules', None) or []) %>
                     <tr>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.none', checked=_user.permission=='repository.none', disabled="disabled" if (used_by_n_rules and _user.username != h.DEFAULT_USER) else None)}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.read', checked=_user.permission=='repository.read', disabled="disabled" if (used_by_n_rules and _user.username != h.DEFAULT_USER) else None)}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.write', checked=_user.permission=='repository.write')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.admin', checked=_user.permission=='repository.admin')}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16, user=_user, tooltip=True)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER}
                                     % if _user.active:
                                         <span class="user-perm-help-text"> - ${_('permission for other logged in and anonymous users')}</span>
                                     % else:
                                         <span class="user-perm-help-text"> - ${_('permission for other logged in users')}</span>
                                     % endif
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                     %if getattr(_user, 'duplicate_perm', None):
                                         (${_('inactive duplicate')})
                                     %endif
                                     %if getattr(_user, 'branch_rules', None):
                                         % if used_by_n_rules == 1:
                                             (${_('used by {} branch rule, requires write+ permissions').format(used_by_n_rules)})
                                         % else:
                                             (${_('used by {} branch rules, requires write+ permissions').format(used_by_n_rules)})
                                         % endif
                                     %endif
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
                           %if _user.username != h.DEFAULT_USER and getattr(_user, 'branch_rules', None) is None:
                             <span class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                             ${_('Remove')}
                             </span>
                           %elif _user.username == h.DEFAULT_USER:
-                            <span class="tooltip btn btn-link btn-default" onclick="setPrivateRepo(true); return false" title="${_('Private repositories are only visible to people explicitly added as collaborators. Default permissions wont apply')}">
+                            <span class="noselect tooltip btn btn-link btn-default" onclick="setPrivateRepo(this, true); return false" title="${_('Private repositories are only visible to people explicitly added as collaborators. Default permissions wont apply')}">
                             ${_('set private mode')}
                             </span>
                           %endif
                         </td>
                         <td class="quick_repo_menu">
                             % if c.rhodecode_user.is_admin:
                                 <i class="icon-more"></i>
                                 <div class="menu_items_container" style="display: none;">
                                 <ul class="menu_items">
                                   <li>
                                      % if _user.username == h.DEFAULT_USER:
                                         ${h.link_to('show permissions', h.route_path('admin_permissions_overview', _anchor='repositories-permissions'))}
                                     % else:
                                         ${h.link_to('show permissions', h.route_path('edit_user_perms_summary', user_id=_user.user_id, _anchor='repositories-permissions'))}
                                     % endif
                                   </li>
                                 </ul>
                                 </div>
                             % endif
                         </td>
                     </tr>
                 %endif
             %endfor
 
             ## USER GROUPS
             %for _user_group in c.rhodecode_db_repo.permission_user_groups(with_members=True):
                 <tr>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.none', checked=_user_group.permission=='repository.none')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.read', checked=_user_group.permission=='repository.read')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.write', checked=_user_group.permission=='repository.write')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.admin', checked=_user_group.permission=='repository.admin')}</td>
                     <td class="td-componentname">
                         ${base.user_group_icon(_user_group, tooltip=True)}
                         %if c.is_super_admin:
                          <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
                         %else:
                          ${h.link_to_group(_user_group.users_group_name)}
                         %endif
                         (${_('members')}: ${len(_user_group.members)})
                     </td>
                     <td class="td-action">
                         <span class="btn btn-link btn-danger revoke_perm"
                               member="${_user_group.users_group_id}" member_type="user_group">
                         ${_('Remove')}
                         </span>
                     </td>
                     <td class="quick_repo_menu">
                         % if c.rhodecode_user.is_admin:
                             <i class="icon-more"></i>
                             <div class="menu_items_container" style="display: none;">
                             <ul class="menu_items">
                               <li>
                                  ${h.link_to('show permissions', h.route_path('edit_user_group_perms_summary', user_group_id=_user_group.users_group_id, _anchor='repositories-permissions'))}
                               </li>
                             </ul>
                             </div>
                         % endif
                     </td>
                 </tr>
             %endfor
             <tr class="new_members" id="add_perm_input"></tr>
 
             <tr>
                 <td></td>
                 <td></td>
                 <td></td>
                 <td></td>
                 <td></td>
                 <td>
                     <span id="add_perm" class="link">
                         ${_('Add user/user group')}
                     </span>
                 </td>
                 <td></td>
             </tr>
 
         </table>
 
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn btn-primary")}
           ${h.reset('reset',_('Reset'),class_="btn btn-danger")}
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script type="text/javascript">
     $('#add_perm').on('click', function(e){
         addNewPermInput($(this), 'repository');
     });
     $('.revoke_perm').on('click', function(e){
         markRevokePermInput($(this), 'repository');
     });
     quick_repo_menu();
 
-    var setPrivateRepo = function (private) {
+    var setPrivateRepo = function (elem, private) {
+        var $elem = $(elem)
+        if ($elem.hasClass('disabled')) {
+            return
+        }
+        $elem.addClass('disabled');
+        $elem.css({"opacity": 0.3})
+
         var postData = {
             'csrf_token': CSRF_TOKEN,
             'private': private
         };
 
         var success = function(o) {
             var defaultUrl = pyroutes.url('edit_repo_perms', {"repo_name": templateContext.repo_name});
             window.location = o.redirect_url || defaultUrl;
         };
 
         ajaxPOST(
             pyroutes.url('edit_repo_perms_set_private', {"repo_name": templateContext.repo_name}),
             postData,
             success);
     }
 </script>