third_party
/
gitea
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Hide 'New Project board' button for users that are not signed in (#12547)

Browse Source 
* hide: 'New Project board' button

* there is no reason to show the button for users that are not signed in

* update template: specifies the condition together with another one

as per lafriks' suggestion in the comment

* chore: add proper user authorization check

* chore: also hide button if repo is archived

* chore: show project board edit/delete menu to authorized users only

* chore: drop the redundant IsSigned check

* CanWriteIssues and CanWritePulls implies (and requires) signed in user

* Add CanWriteProjects and properly assert permissions

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
tokarchuk/v1.17
wULLSnpAXbWZGYDYyhWTKKspEQoaYxXyhoisqHf 4 years ago committed by GitHub
parent a0484890c1
commit d4e35b9dc6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 112 additions and 106 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 17
      routers/repo/projects.go
  2. 37
      routers/routes/routes.go
  3. 62
      templates/repo/projects/list.tmpl
  4. 2
      templates/repo/projects/new.tmpl
  5. 100
      templates/repo/projects/view.tmpl

17
routers/repo/projects.go
Unescape View File

@ -95,6 +95,7 @@ func Projects(ctx *context.Context) {
pager.AddParam(ctx, "state", "State") pager.AddParam(ctx, "state", "State")
ctx.Data["Page"] = pager ctx.Data["Page"] = pager
ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(models.UnitTypeProjects)
ctx.Data["IsShowClosed"] = isShowClosed ctx.Data["IsShowClosed"] = isShowClosed
ctx.Data["IsProjectsPage"] = true ctx.Data["IsProjectsPage"] = true
ctx.Data["SortType"] = sortType ctx.Data["SortType"] = sortType
@ -106,16 +107,17 @@ func Projects(ctx *context.Context) {
func NewProject(ctx *context.Context) { func NewProject(ctx *context.Context) {
ctx.Data["Title"] = ctx.Tr("repo.projects.new") ctx.Data["Title"] = ctx.Tr("repo.projects.new")
ctx.Data["ProjectTypes"] = models.GetProjectsConfig() ctx.Data["ProjectTypes"] = models.GetProjectsConfig()
ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(models.UnitTypeProjects)
ctx.HTML(200, tplProjectsNew) ctx.HTML(200, tplProjectsNew)
} }
// NewRepoProjectPost creates a new project // NewProjectPost creates a new project
func NewRepoProjectPost(ctx *context.Context, form auth.CreateProjectForm) { func NewProjectPost(ctx *context.Context, form auth.CreateProjectForm) {
ctx.Data["Title"] = ctx.Tr("repo.projects.new") ctx.Data["Title"] = ctx.Tr("repo.projects.new")
if ctx.HasError() { if ctx.HasError() {
ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(models.UnitTypeProjects)
ctx.Data["ProjectTypes"] = models.GetProjectsConfig()
ctx.HTML(200, tplProjectsNew) ctx.HTML(200, tplProjectsNew)
return return
} }
@ -192,6 +194,7 @@ func EditProject(ctx *context.Context) {
ctx.Data["Title"] = ctx.Tr("repo.projects.edit") ctx.Data["Title"] = ctx.Tr("repo.projects.edit")
ctx.Data["PageIsProjects"] = true ctx.Data["PageIsProjects"] = true
ctx.Data["PageIsEditProjects"] = true ctx.Data["PageIsEditProjects"] = true
ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(models.UnitTypeProjects)
p, err := models.GetProjectByID(ctx.ParamsInt64(":id")) p, err := models.GetProjectByID(ctx.ParamsInt64(":id"))
if err != nil { if err != nil {
@ -218,9 +221,10 @@ func EditProjectPost(ctx *context.Context, form auth.CreateProjectForm) {
ctx.Data["Title"] = ctx.Tr("repo.projects.edit") ctx.Data["Title"] = ctx.Tr("repo.projects.edit")
ctx.Data["PageIsProjects"] = true ctx.Data["PageIsProjects"] = true
ctx.Data["PageIsEditProjects"] = true ctx.Data["PageIsEditProjects"] = true
ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(models.UnitTypeProjects)
if ctx.HasError() { if ctx.HasError() {
ctx.HTML(200, tplMilestoneNew) ctx.HTML(200, tplProjectsNew)
return return
} }
@ -287,6 +291,7 @@ func ViewProject(ctx *context.Context) {
return return
} }
ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(models.UnitTypeProjects)
ctx.Data["Project"] = project ctx.Data["Project"] = project
ctx.Data["Boards"] = allBoards ctx.Data["Boards"] = allBoards
ctx.Data["PageIsProjects"] = true ctx.Data["PageIsProjects"] = true
@ -551,6 +556,7 @@ func MoveIssueAcrossBoards(ctx *context.Context) {
func CreateProject(ctx *context.Context) { func CreateProject(ctx *context.Context) {
ctx.Data["Title"] = ctx.Tr("repo.projects.new") ctx.Data["Title"] = ctx.Tr("repo.projects.new")
ctx.Data["ProjectTypes"] = models.GetProjectsConfig() ctx.Data["ProjectTypes"] = models.GetProjectsConfig()
ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(models.UnitTypeProjects)
ctx.HTML(200, tplGenericProjectsNew) ctx.HTML(200, tplGenericProjectsNew)
} }
@ -566,6 +572,7 @@ func CreateProjectPost(ctx *context.Context, form auth.UserCreateProjectForm) {
ctx.Data["ContextUser"] = user ctx.Data["ContextUser"] = user
if ctx.HasError() { if ctx.HasError() {
ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(models.UnitTypeProjects)
ctx.HTML(200, tplGenericProjectsNew) ctx.HTML(200, tplGenericProjectsNew)
return return
} }

37
routers/routes/routes.go
Unescape View File

@ -535,6 +535,7 @@ func RegisterRoutes(m *macaron.Macaron) {
reqRepoIssuesOrPullsWriter := context.RequireRepoWriterOr(models.UnitTypeIssues, models.UnitTypePullRequests) reqRepoIssuesOrPullsWriter := context.RequireRepoWriterOr(models.UnitTypeIssues, models.UnitTypePullRequests)
reqRepoIssuesOrPullsReader := context.RequireRepoReaderOr(models.UnitTypeIssues, models.UnitTypePullRequests) reqRepoIssuesOrPullsReader := context.RequireRepoReaderOr(models.UnitTypeIssues, models.UnitTypePullRequests)
reqRepoProjectsReader := context.RequireRepoReader(models.UnitTypeProjects) reqRepoProjectsReader := context.RequireRepoReader(models.UnitTypeProjects)
reqRepoProjectsWriter := context.RequireRepoWriter(models.UnitTypeProjects)
// ***** START: Organization ***** // ***** START: Organization *****
m.Group("/org", func() { m.Group("/org", func() {
@ -858,24 +859,26 @@ func RegisterRoutes(m *macaron.Macaron) {
m.Group("/projects", func() { m.Group("/projects", func() {
m.Get("", repo.Projects) m.Get("", repo.Projects)
m.Get("/new", repo.NewProject) m.Get("/:id", repo.ViewProject)
m.Post("/new", bindIgnErr(auth.CreateProjectForm{}), repo.NewRepoProjectPost) m.Group("", func() {
m.Group("/:id", func() { m.Get("/new", repo.NewProject)
m.Get("", repo.ViewProject) m.Post("/new", bindIgnErr(auth.CreateProjectForm{}), repo.NewProjectPost)
m.Post("", bindIgnErr(auth.EditProjectBoardTitleForm{}), repo.AddBoardToProjectPost) m.Group("/:id", func() {
m.Post("/delete", repo.DeleteProject) m.Post("", bindIgnErr(auth.EditProjectBoardTitleForm{}), repo.AddBoardToProjectPost)
m.Post("/delete", repo.DeleteProject)
m.Get("/edit", repo.EditProject)
m.Post("/edit", bindIgnErr(auth.CreateProjectForm{}), repo.EditProjectPost) m.Get("/edit", repo.EditProject)
m.Post("/^:action(open|close)$", repo.ChangeProjectStatus) m.Post("/edit", bindIgnErr(auth.CreateProjectForm{}), repo.EditProjectPost)
m.Post("/^:action(open|close)$", repo.ChangeProjectStatus)
m.Group("/:boardID", func() {
m.Put("", bindIgnErr(auth.EditProjectBoardTitleForm{}), repo.EditProjectBoardTitle) m.Group("/:boardID", func() {
m.Delete("", repo.DeleteProjectBoard) m.Put("", bindIgnErr(auth.EditProjectBoardTitleForm{}), repo.EditProjectBoardTitle)
m.Delete("", repo.DeleteProjectBoard)
m.Post("/:index", repo.MoveIssueAcrossBoards)
m.Post("/:index", repo.MoveIssueAcrossBoards)
})
}) })
}) }, reqRepoProjectsWriter, context.RepoMustNotBeArchived())
}, reqRepoProjectsReader, repo.MustEnableProjects) }, reqRepoProjectsReader, repo.MustEnableProjects)
m.Group("/wiki", func() { m.Group("/wiki", func() {

62
templates/repo/projects/list.tmpl
Unescape View File

@ -4,10 +4,10 @@
<div class="ui container"> <div class="ui container">
<div class="navbar"> <div class="navbar">
{{template "repo/issue/navbar" .}} {{template "repo/issue/navbar" .}}
{{if and (or .CanWriteIssues .CanWritePulls) (not .Repository.IsArchived)}} {{if and .CanWriteProjects (not .Repository.IsArchived)}}
<div class="ui right"> <div class="ui right">
<a class="ui green button" href="{{$.Link}}/new">{{.i18n.Tr "repo.projects.new"}}</a> <a class="ui green button" href="{{$.Link}}/new">{{.i18n.Tr "repo.projects.new"}}</a>
</div> </div>
{{end}} {{end}}
</div> </div>
<div class="ui divider"></div> <div class="ui divider"></div>
@ -39,35 +39,35 @@
</div> </div>
<div class="milestone list"> <div class="milestone list">
{{range .Projects}} {{range .Projects}}
<li class="item"> <li class="item">
{{svg "octicon-project" 16}} <a href="{{$.RepoLink}}/projects/{{.ID}}">{{.Title}}</a> {{svg "octicon-project" 16}} <a href="{{$.RepoLink}}/projects/{{.ID}}">{{.Title}}</a>
<div class="meta"> <div class="meta">
{{ $closedDate:= TimeSinceUnix .ClosedDateUnix $.Lang }} {{ $closedDate:= TimeSinceUnix .ClosedDateUnix $.Lang }}
{{if .IsClosed }} {{if .IsClosed }}
{{svg "octicon-clock" 16}} {{$.i18n.Tr "repo.milestones.closed" $closedDate|Str2html}} {{svg "octicon-clock" 16}} {{$.i18n.Tr "repo.milestones.closed" $closedDate|Str2html}}
{{end}}
<span class="issue-stats">
{{svg "octicon-issue-opened" 16}} {{$.i18n.Tr "repo.issues.open_tab" .NumOpenIssues}}
{{svg "octicon-issue-closed" 16}} {{$.i18n.Tr "repo.issues.close_tab" .NumClosedIssues}}
</span>
</div>
{{if and (or $.CanWriteIssues $.CanWritePulls) (not $.Repository.IsArchived)}}
<div class="ui right operate">
<a href="{{$.Link}}/{{.ID}}/edit" data-id={{.ID}} data-title={{.Title}}>{{svg "octicon-pencil" 16}} {{$.i18n.Tr "repo.issues.label_edit"}}</a>
{{if .IsClosed}}
<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/open">{{svg "octicon-check" 16}} {{$.i18n.Tr "repo.projects.open"}}</a>
{{else}}
<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/close">{{svg "octicon-x" 16}} {{$.i18n.Tr "repo.projects.close"}}</a>
{{end}}
<a class="delete-button" href="#" data-url="{{$.RepoLink}}/projects/{{.ID}}/delete" data-id="{{.ID}}">{{svg "octicon-trashcan" 16}} {{$.i18n.Tr "repo.issues.label_delete"}}</a>
</div>
{{end}} {{end}}
<span class="issue-stats"> {{if .Description}}
{{svg "octicon-issue-opened" 16}} {{$.i18n.Tr "repo.issues.open_tab" .NumOpenIssues}} <div class="content">
{{svg "octicon-issue-closed" 16}} {{$.i18n.Tr "repo.issues.close_tab" .NumClosedIssues}} {{.RenderedContent|Str2html}}
</span> </div>
</div>
{{if and (or $.CanWriteIssues $.CanWritePulls) (not $.Repository.IsArchived)}}
<div class="ui right operate">
<a href="{{$.Link}}/{{.ID}}/edit" data-id={{.ID}} data-title={{.Title}}>{{svg "octicon-pencil" 16}} {{$.i18n.Tr "repo.issues.label_edit"}}</a>
{{if .IsClosed}}
<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/open">{{svg "octicon-check" 16}} {{$.i18n.Tr "repo.projects.open"}}</a>
{{else}}
<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/close">{{svg "octicon-x" 16}} {{$.i18n.Tr "repo.projects.close"}}</a>
{{end}} {{end}}
<a class="delete-button" href="#" data-url="{{$.RepoLink}}/projects/{{.ID}}/delete" data-id="{{.ID}}">{{svg "octicon-trashcan" 16}} {{$.i18n.Tr "repo.issues.label_delete"}}</a> </li>
</div>
{{end}}
{{if .Description}}
<div class="content">
{{.RenderedContent|Str2html}}
</div>
{{end}}
</li>
{{end}} {{end}}
{{template "base/paginate" .}} {{template "base/paginate" .}}

2
templates/repo/projects/new.tmpl
Unescape View File

@ -4,7 +4,7 @@
<div class="ui container"> <div class="ui container">
<div class="navbar"> <div class="navbar">
{{template "repo/issue/navbar" .}} {{template "repo/issue/navbar" .}}
{{if and (or .CanWriteIssues .CanWritePulls) .PageIsEditProject}} {{if and .CanWriteProjects .PageIsEditProject}}
<div class="ui right floated secondary menu"> <div class="ui right floated secondary menu">
<a class="ui green button" href="{{$.RepoLink}}/projects/new">{{.i18n.Tr "repo.milestones.new"}}</a> <a class="ui green button" href="{{$.RepoLink}}/projects/new">{{.i18n.Tr "repo.milestones.new"}}</a>
</div> </div>

100
templates/repo/projects/view.tmpl
Unescape View File

@ -10,10 +10,9 @@
{{template "repo/issue/search" .}} {{template "repo/issue/search" .}}
</div> </div>
<div class="column right aligned"> <div class="column right aligned">
{{if .PageIsProjects}} {{if and .CanWriteProjects (not .Repository.IsArchived) .PageIsProjects}}
<a class="ui green button show-modal item" data-modal="#new-board-item">{{.i18n.Tr "new_project_board"}}</a> <a class="ui green button show-modal item" data-modal="#new-board-item">{{.i18n.Tr "new_project_board"}}</a>
{{end}} {{end}}
<div class="ui small modal" id="new-board-item"> <div class="ui small modal" id="new-board-item">
<div class="header"> <div class="header">
{{$.i18n.Tr "repo.projects.board.new"}} {{$.i18n.Tr "repo.projects.board.new"}}
@ -45,65 +44,62 @@
<div class="ui segment board-column"> <div class="ui segment board-column">
<div class="board-column-header"> <div class="board-column-header">
<div class="ui large label board-label">{{.Title}}</div> <div class="ui large label board-label">{{.Title}}</div>
{{if and $.CanWriteProjects (not $.Repository.IsArchived) $.PageIsProjects (ne .ID 0)}}
{{ if $.IsSigned }} <div class="ui dropdown jump item poping up right" data-variation="tiny inverted">
{{ if not (eq .ID 0) }} <span class="ui text">
<div class="ui dropdown jump item poping up right" data-variation="tiny inverted"> <img class="ui tiny avatar image" width="24" height="24">
<span class="ui text"> <span class="fitted not-mobile" tabindex="-1">{{svg "octicon-kebab-horizontal" 24}}</span>
<img class="ui tiny avatar image" width="24" height="24"> </span>
<span class="fitted not-mobile" tabindex="-1">{{svg "octicon-kebab-horizontal" 24}}</span> <div class="menu user-menu" tabindex="-1">
</span> <a class="item show-modal button" data-modal="#edit-project-board-modal-{{.ID}}">
<div class="menu user-menu" tabindex="-1"> {{svg "octicon-pencil" 16}}
<a class="item show-modal button" data-modal="#edit-project-board-modal-{{.ID}}">
{{svg "octicon-pencil" 16}}
{{$.i18n.Tr "repo.projects.board.edit"}}
</a>
<a class="item show-modal button" data-modal="#delete-board-modal-{{.ID}}">
{{svg "octicon-trashcan" 16}}
{{$.i18n.Tr "repo.projects.board.delete"}}
</a>
<div class="ui small modal edit-project-board" id="edit-project-board-modal-{{.ID}}">
<div class="header">
{{$.i18n.Tr "repo.projects.board.edit"}} {{$.i18n.Tr "repo.projects.board.edit"}}
</a>
<a class="item show-modal button" data-modal="#delete-board-modal-{{.ID}}">
{{svg "octicon-trashcan" 16}}
{{$.i18n.Tr "repo.projects.board.delete"}}
</a>
<div class="ui small modal edit-project-board" id="edit-project-board-modal-{{.ID}}">
<div class="header">
{{$.i18n.Tr "repo.projects.board.edit"}}
</div>
<div class="content">
<form class="ui form">
<div class="required field">
<label for="new_board_title">{{$.i18n.Tr "repo.projects.board.edit_title"}}</label>
<input class="project-board-title" id="new_board_title" name="title" value="{{.Title}}" required>
</div>
<div class="text right actions">
<div class="ui cancel button">{{$.i18n.Tr "settings.cancel"}}</div>
<button data-url="{{$.RepoLink}}/projects/{{$.Project.ID}}/{{.ID}}" class="ui red button">{{$.i18n.Tr "repo.projects.board.edit"}}</button>
</div>
</form>
</div>
</div> </div>
<div class="content">
<form class="ui form">
<div class="required field">
<label for="new_board_title">{{$.i18n.Tr "repo.projects.board.edit_title"}}</label>
<input class="project-board-title" id="new_board_title" name="title" value="{{.Title}}" required>
</div>
<div class="ui basic modal" id="delete-board-modal-{{.ID}}">
<div class="ui icon header">
{{$.i18n.Tr "repo.projects.board.delete"}}
</div>
<div class="content center">
<input type="hidden" name="action" value="delete">
<div class="field">
<label>
{{$.i18n.Tr "repo.projects.board.deletion_desc"}}
</label>
</div>
</div>
<form class="ui form" method="post">
<div class="text right actions"> <div class="text right actions">
<div class="ui cancel button">{{$.i18n.Tr "settings.cancel"}}</div> <div class="ui cancel button">{{$.i18n.Tr "settings.cancel"}}</div>
<button data-url="{{$.RepoLink}}/projects/{{$.Project.ID}}/{{.ID}}" class="ui red button">{{$.i18n.Tr "repo.projects.board.edit"}}</button> <button class="ui red button delete-project-board" data-url="{{$.RepoLink}}/projects/{{$.Project.ID}}/{{.ID}}">{{$.i18n.Tr "repo.projects.board.delete"}}</button>
</div> </div>
</form> </form>
</div> </div>
</div> </div>
<div class="ui basic modal" id="delete-board-modal-{{.ID}}">
<div class="ui icon header">
{{$.i18n.Tr "repo.projects.board.delete"}}
</div>
<div class="content center">
<input type="hidden" name="action" value="delete">
<div class="field">
<label>
{{$.i18n.Tr "repo.projects.board.deletion_desc"}}
</label>
</div>
</div>
<form class="ui form" method="post">
<div class="text right actions">
<div class="ui cancel button">{{$.i18n.Tr "settings.cancel"}}</div>
<button class="ui red button delete-project-board" data-url="{{$.RepoLink}}/projects/{{$.Project.ID}}/{{.ID}}">{{$.i18n.Tr "repo.projects.board.delete"}}</button>
</div>
</form>
</div>
</div> </div>
</div>
{{ end }}
{{ end }} {{ end }}
</div> </div>
<div class="ui divider"></div> <div class="ui divider"></div>

Write Preview
Loading…
Cancel
Save