Implemented #738 Giving a user WRITE+ permissions on folder should not allow repo creation in root folder.

user can create repos only if he got explicitly permission for creating repos globally, or have WRITE+ permission on a group.
Then he can create repositories inside this group

rhodecode/controllers/admin/repos.py

@@ -28,7 +28,7 b' import traceback'
 import formencode
 from formencode import htmlfill
 
-from webob.exc import HTTPInternalServerError
+from webob.exc import HTTPInternalServerError, HTTPForbidden
 from pylons import request, session, tmpl_context as c, url
 from pylons.controllers.util import redirect
 from pylons.i18n.translation import _
@@ -37,7 +37,8 b' from sqlalchemy.exc import IntegrityErro'
 import rhodecode
 from rhodecode.lib import helpers as h
 from rhodecode.lib.auth import LoginRequired, HasPermissionAllDecorator, \
-    HasPermissionAnyDecorator, HasRepoPermissionAllDecorator
+    HasPermissionAnyDecorator, HasRepoPermissionAllDecorator, NotAnonymous,\
+    HasPermissionAny, HasReposGroupPermissionAny
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.utils import invalidate_cache, action_logger, repo_name_slug
 from rhodecode.lib.helpers import get_token
@@ -61,7 +62,6 b' class ReposController(BaseRepoController'
     #     map.resource('repo', 'repos')
 
     @LoginRequired()
-    @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')
     def __before__(self):
         c.admin_user = session.get('admin_user')
         c.admin_username = session.get('admin_username')
@@ -148,7 +148,7 b' class ReposController(BaseRepoController'
 
         return render('admin/repos/repos.html')
 
-    @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')
+    @NotAnonymous()
     def create(self):
         """
         POST /repos: Create a new item"""
@@ -160,6 +160,20 b' class ReposController(BaseRepoController'
             form_result = RepoForm(repo_groups=c.repo_groups_choices,
                                    landing_revs=c.landing_revs_choices)()\
                             .to_python(dict(request.POST))
+            #we check ACLs after form, since we want to display nicer errors
+            #if form forbids creation of repos inside a group we don't have
+            #perms for
+            if not HasPermissionAny('hg.admin', 'hg.create.repository')():
+                #you're not super admin nor have global create permissions,
+                #but maybe you have at least write permission to a parent group ?
+                parent_group = request.POST.get('repo_group')
+                _gr = RepoGroup.get(parent_group)
+                gr_name = _gr.group_name if _gr else None
+                if not HasReposGroupPermissionAny('group.admin', 'group.write')(group_name=gr_name):
+                    msg = _('no permission to create repository in root location')
+                    raise formencode.Invalid('', form_result, None,
+                                             error_dict={'repo_group': msg})
+
             new_repo = RepoModel().create(form_result,
                                           self.rhodecode_user.user_id)
             if form_result['clone_uri']:
@@ -181,16 +195,8 b' class ReposController(BaseRepoController'
                               self.sa)
             Session().commit()
         except formencode.Invalid, errors:
-
-            c.new_repo = errors.value['repo_name']
-
-            if request.POST.get('user_created'):
-                r = render('admin/repos/repo_add_create_repository.html')
-            else:
-                r = render('admin/repos/repo_add.html')
-
             return htmlfill.render(
-                r,
+                render('admin/repos/repo_add.html'),
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
@@ -201,7 +207,9 b' class ReposController(BaseRepoController'
             msg = _('error occurred during creation of repository %s') \
                     % form_result.get('repo_name')
             h.flash(msg, category='error')
-            return redirect(url('repos'))
+            if c.rhodecode_user.is_admin:
+                return redirect(url('repos'))
+            return redirect(url('home'))
         #redirect to our new repo !
         return redirect(url('summary_home', repo_name=new_repo.repo_name))
 
@@ -213,10 +221,7 b' class ReposController(BaseRepoController'
         GET /repos/new: Form to create a new item
         """
 
-        new_repo = request.GET.get('repo', '')
         parent_group = request.GET.get('parent_group')
-
-        c.new_repo = repo_name_slug(new_repo)
         self.__load_defaults()
         ## apply the defaults from defaults page
         defaults = RhodeCodeSetting.get_default_repo_settings(strip_prefix=True)

rhodecode/controllers/admin/settings.py

@@ -37,7 +37,8 b' from pylons.i18n.translation import _'
 
 from rhodecode.lib import helpers as h
 from rhodecode.lib.auth import LoginRequired, HasPermissionAllDecorator, \
-    HasPermissionAnyDecorator, NotAnonymous
+    HasPermissionAnyDecorator, NotAnonymous, HasPermissionAny,\
+    HasReposGroupPermissionAll, HasReposGroupPermissionAny
 from rhodecode.lib.base import BaseController, render
 from rhodecode.lib.celerylib import tasks, run_task
 from rhodecode.lib.utils import repo2db_mapper, invalidate_cache, \
@@ -54,6 +55,7 b' from rhodecode.model.notification import'
 from rhodecode.model.meta import Session
 from rhodecode.lib.utils2 import str2bool, safe_unicode
 from rhodecode.lib.compat import json
+from webob.exc import HTTPForbidden
 log = logging.getLogger(__name__)
 
 
@@ -484,9 +486,17 b' class SettingsController(BaseController)'
         return render('admin/users/user_edit_my_account_pullrequests.html')
 
     @NotAnonymous()
-    @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')
     def create_repository(self):
         """GET /_admin/create_repository: Form to create a new item"""
+        new_repo = request.GET.get('repo', '')
+        parent_group = request.GET.get('parent_group')
+        if not HasPermissionAny('hg.admin', 'hg.create.repository')():
+            #you're not super admin nor have global create permissions,
+            #but maybe you have at least write permission to a parent group ?
+            _gr = RepoGroup.get(parent_group)
+            gr_name = _gr.group_name if _gr else None
+            if not HasReposGroupPermissionAny('group.admin', 'group.write')(group_name=gr_name):
+                raise HTTPForbidden
 
         acl_groups = GroupList(RepoGroup.query().all(),
                                perm_set=['group.write', 'group.admin'])
@@ -494,8 +504,6 b' class SettingsController(BaseController)'
         c.repo_groups_choices = map(lambda k: unicode(k[0]), c.repo_groups)
         choices, c.landing_revs = ScmModel().get_repo_landing_revs()
 
-        new_repo = request.GET.get('repo', '')
-        parent_group = request.GET.get('parent_group')
         c.new_repo = repo_name_slug(new_repo)
 
         ## apply the defaults from defaults page
@@ -504,7 +512,7 b' class SettingsController(BaseController)'
             defaults.update({'repo_group': parent_group})
 
         return htmlfill.render(
-            render('admin/repos/repo_add_create_repository.html'),
+            render('admin/repos/repo_add.html'),
             defaults=defaults,
             errors={},
             prefix_error=False,

rhodecode/templates/admin/repos/repo_add.html

@@ -6,9 +6,15 b''
 </%def>
 
 <%def name="breadcrumbs_links()">
+    %if c.rhodecode_user.is_admin:
     ${h.link_to(_('Admin'),h.url('admin_home'))}
     &raquo;
     ${h.link_to(_('Repositories'),h.url('repos'))}
+    %else:
+    ${_('Admin')}
+    &raquo;
+    ${_('Repositories')}    
+    %endif
     &raquo;
     ${_('add new')}
 </%def>

rhodecode/templates/admin/repos/repo_add_base.html

@@ -9,8 +9,8 b''
                 <label for="repo_name">${_('Name')}:</label>
             </div>
             <div class="input">
-                ${h.text('repo_name',c.new_repo,class_="small")}
-                %if not h.HasPermissionAll('hg.admin')('repo create form'):
+                ${h.text('repo_name',class_="small")}
+                %if not c.rhodecode_user.is_admin:
                     ${h.hidden('user_created',True)}
                 %endif
             </div>

rhodecode/templates/index_base.html

@@ -7,12 +7,10 b''
             </h5>
             %if c.rhodecode_user.username != 'default':
               <ul class="links">
-                %if h.HasPermissionAny('hg.admin','hg.create.repository')():
+                %if h.HasPermissionAny('hg.admin','hg.create.repository')() or h.HasReposGroupPermissionAny('group.write', 'group.admin')(c.group.group_name if c.group else None):
                   <li>
                   %if c.group:
-                    %if h.HasReposGroupPermissionAny('group.write', 'group.admin')(c.group.group_name):
                         <span>${h.link_to(_('Add repository'),h.url('admin_settings_create_repository',parent_group=c.group.group_id))}</span>
-                    %endif
                   %else:
                     <span>${h.link_to(_('Add repository'),h.url('admin_settings_create_repository'))}</span>
                   %endif