[api] forbid creation of set_bugowner action without person and group

openSUSE · Apr 30, 2014 · aa076ad · aa076ad
1 parent c291f5f
commit aa076ad
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 0 deletions.
diff --git a/src/api/app/models/bs_request_action_set_bugowner.rb b/src/api/app/models/bs_request_action_set_bugowner.rb
@@ -4,6 +4,13 @@ def self.sti_name
     return :set_bugowner
   end
 
+  def check_sanity
+    super
+    if person_name.blank? && group_name.blank?
+      errors.add(:person_name, "Either person or group needs to be set")
+    end
+  end
+
   def execute_accept(opts)
     object = Project.find_by_name!(self.target_project)
     bugowner = Role.find_by_title!("bugowner")

diff --git a/src/api/test/functional/request_controller_test.rb b/src/api/test/functional/request_controller_test.rb
@@ -340,6 +340,47 @@ def test_set_bugowner_request
     assert_response :success
   end
 
+  def test_invalid_bugowner_requests
+    login_Iggy
+    raw_put '/source/home:Iggy:Test/_meta', "<project name='home:Iggy:Test'><title></title><description></description> </project>"
+    assert_response :success
+
+    login_adrian
+    post '/request?cmd=create', '<request>
+                                   <action type="set_bugowner">
+                                     <target project="home:Iggy:Test"/>
+                                   </action>
+                                   <state name="new" />
+                                 </request>'
+    assert_response 400
+    assert_xml_tag(:tag => 'status', :attributes => { code: 'invalid_record' })
+
+    post '/request?cmd=create', '<request>
+                                   <action type="set_bugowner">
+                                     <target project="home:Iggy:Test"/>
+                                     <person name="DOESNOTEXIST" />
+                                   </action>
+                                   <state name="new" />
+                                 </request>'
+    assert_response 404
+    assert_xml_tag(:tag => 'status', :attributes => { code: 'not_found' })
+
+    post '/request?cmd=create', '<request>
+                                   <action type="set_bugowner">
+                                     <target project="home:Iggy:Test"/>
+                                     <group name="DOESNOTEXIST" />
+                                   </action>
+                                   <state name="new" />
+                                 </request>'
+    assert_response 404
+    assert_xml_tag(:tag => 'status', :attributes => { code: 'not_found' })
+
+    # cleanup
+    login_Iggy
+    delete '/source/home:Iggy:Test'
+    assert_response :success
+  end
+
   def test_set_bugowner_request_locked_project
     login_Iggy
     raw_put '/source/home:Iggy:Test/_meta', "<project name='home:Iggy:Test'><title></title><description></description>  <lock><enable/></lock></project>"