[api] do not allow to accept requests which are not in new state (or …

…review with force parameter). Regression fix

src/api/app/controllers/request_controller.rb

@@ -681,9 +681,13 @@ def check_request_change(req, params)
     end
 
     # Do not accept to skip the review, except force argument is given
-    if params[:newstate] == "accepted"
-      if params[:cmd] == "changestate" and req.state == :review and not params[:force]
-        raise PostRequestNoPermission.new "Request is in review state. You may use the force parameter to ignore this."
+    if params[:cmd] == "changestate"  and params[:newstate] == "accepted"
+      if req.state == :review 
+        unless params[:force]
+i          raise PostRequestNoPermission.new "Request is in review state. You may use the force parameter to ignore this."
+        end
+      elsif req.state != :new
+        raise PostRequestNoPermission.new "Request is not in new state. You may reopen it by setting it to new."
       end
     end
 

src/api/test/functional/request_controller_test.rb

@@ -1883,8 +1883,18 @@ def test_branch_version_update_and_submit_request_back
     assert node.has_attribute?(:id)
     id = node.value(:id)
 
-    # accept the request
+    # decline it and try to accept it
+    # must not work to avoid races between multiple users
     prepare_request_with_user "king", "sunflower"
+    post "/request/#{id}?cmd=changestate&newstate=declined"
+    assert_response :success
+    post "/request/#{id}?cmd=changestate&newstate=accepted"
+    assert_response 403
+    assert_xml_tag(:tag => "status", :attributes => {:code => 'post_request_no_permission'})
+    assert_xml_tag(:tag => "summary", :content => "Request is not in new state. You may reopen it by setting it to new.")
+    # reopen and accept the request
+    post "/request/#{id}?cmd=changestate&newstate=new"
+    assert_response :success
     post "/request/#{id}?cmd=changestate&newstate=accepted"
     assert_response :success