[api] fix assignreview command

do not accept reviews for other users

src/api/app/models/bs_request.rb

@@ -498,6 +498,7 @@ def assignreview(opts = {})
 
     self.with_lock do
       self.reviews.reverse.each do |review|
+        next if review.by_user
         next if review.by_group && review.by_group != opts[:by_group]
         next if review.by_project && review.by_project != opts[:by_project]
         next if review.by_package && review.by_package != opts[:by_package]

src/api/test/functional/request_controller_test.rb

@@ -901,6 +901,8 @@ def test_create_request_and_multiple_reviews
 
     # add reviewer group
     login_Iggy
+    post "/request/#{id}?cmd=addreview&by_user=king"
+    assert_response :success
     post "/request/#{id}?cmd=addreview&by_group=test_group"
     assert_response :success
     post "/request/#{id}?cmd=addreview&by_group=test_group_b"
@@ -911,10 +913,18 @@ def test_create_request_and_multiple_reviews
 
     # adrian assigns to adrian_downloader
     login_adrian
+    get "/request/#{id}"
+    assert_response :success
+    assert_no_xml_tag(:tag => 'review', :attributes => { state: 'new', by_user: 'adrian_downloader' })
+    assert_xml_tag(:tag => 'review', :attributes => { state: 'new', by_user: 'king' })
+    assert_xml_tag(:tag => 'review', :attributes => { state: 'new', by_group: 'test_group' })
     post "/request/#{id}?by_group=test_group&cmd=assignreview&reviewer=adrian_downloader", 'adrian_downloader, please have a look'
     assert_response :success
     get "/request/#{id}"
     assert_response :success
+    assert_xml_tag(:tag => 'review', :attributes => { state: 'new', by_user: 'adrian_downloader' })
+    assert_xml_tag(:tag => 'review', :attributes => { state: 'new', by_user: 'king' })
+    assert_xml_tag(:tag => 'review', :attributes => { state: 'accepted', by_group: 'test_group' })
 
     login_adrian_downloader
     post "/request/#{id}?cmd=changereviewstate&newstate=accepted&by_user=adrian_downloader"