796964 - The 'Sync Product' permission no longer allows a user to edit a

repository.
daviddavis · Feb 28, 2012 · f61c2db · f61c2db
1 parent c697080
commit f61c2db
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 14 deletions.
diff --git a/src/app/controllers/gpg_keys_controller.rb b/src/app/controllers/gpg_keys_controller.rb
@@ -40,15 +40,15 @@ def rules
       :new => create_test,
       :create => create_test,
 
-      :edit => manage_test,
+      :edit => read_test,
       :update => manage_test,
 
       :destroy => manage_test
     }
   end
 
   def items
-    render_panel_direct(GpgKey, @panel_options, params[:search], params[:offset], [:name, :asc],
+    render_panel_direct(GpgKey, @panel_options, params[:search], params[:offset], [:name_sort, :asc],
       :filter=>{:organization_id=>[current_organization.id]})
   end
 

diff --git a/src/app/controllers/repositories_controller.rb b/src/app/controllers/repositories_controller.rb
@@ -29,7 +29,7 @@ def rules
     {
       :new => edit_test,
       :create => edit_test,
-      :edit =>read_test,
+      :edit => read_test,
       :update_gpg_key => edit_test,
       :destroy => edit_test,
       :enable_repo => org_edit,

diff --git a/src/app/models/provider.rb b/src/app/models/provider.rb
@@ -197,7 +197,7 @@ def sanitize_repository_url
   def self.items org, verbs
     raise "scope requires an organization" if org.nil?
     resource = :providers
-    if org.syncable? ||  User.allowed_all_tags?(verbs, resource, org)
+    if verbs.include?(:read) && org.syncable? || User.allowed_all_tags?(verbs, resource, org)
        where(:organization_id => org)
     else
       where("providers.id in (#{User.allowed_tags_sql(verbs, resource, org)})")

diff --git a/src/app/views/gpg_keys/_edit.html.haml b/src/app/views/gpg_keys/_edit.html.haml
@@ -25,16 +25,17 @@
           %label #{_("Name")}:
         .grid_8.la#gpg_key_name{'name' => 'gpg_key[name]', :class => ("editable edit_panel_element" if editable), 'data-url' => gpg_key_path(@gpg_key.id)} #{@gpg_key[:name]}
       = form_tag gpg_key_path(@gpg_key.id), :method => "post", "data-url" => gpg_key_path(@gpg_key.id), :id => "upload_gpg_key" do
-        %fieldset
-          .grid_1.ra
-            %label #{_("Upload")}:
-          .grid_3.la
-            = file_field_tag 'gpg_key[content_upload]', :id => "gpg_key_content_upload_update", :tabindex => auto_tab_index
-        %fieldset
-          .grid_2.la.push_1
-            %input.button{ "type" => "button", :id => :update_upload_gpg_key, :disabled => "disabled", :tabindex => auto_tab_index, "value" => _("Upload") }
-          .grid_1.push_2.ra
-            %input.button{ "type" => "button", :id => :clear_upload_gpg_key, :disabled => "disabled", :tabindex => auto_tab_index, "value" => _("Clear") }
+        - if editable
+          %fieldset
+            .grid_1.ra
+              %label #{_("Upload")}:
+            .grid_3.la
+              = file_field_tag 'gpg_key[content_upload]', :id => "gpg_key_content_upload_update", :tabindex => auto_tab_index
+          %fieldset
+            .grid_2.la.push_1
+              %input.button{ "type" => "button", :id => :update_upload_gpg_key, :disabled => "disabled", :tabindex => auto_tab_index, "value" => _("Upload") }
+            .grid_1.push_2.ra
+              %input.button{ "type" => "button", :id => :clear_upload_gpg_key, :disabled => "disabled", :tabindex => auto_tab_index, "value" => _("Clear") }
       %fieldset
         .grid_1.ra
           %label #{_("Key")}: