[api] validate specified releasetargets in _patchinfo files

src/api/app/controllers/source_controller.rb

@@ -1097,7 +1097,7 @@ def file
         end
       end
 
-      # set patchinfo information in db
+      # verify patchinfo data
       if params[:file] == "_patchinfo"
         data = ActiveXML::Base.new(request.raw_post.to_s)
         if data and data.packager
@@ -1108,6 +1108,27 @@ def file
           end
           packager = User.get_by_login data.packager.to_s unless packager
         end
+        # are releasetargets specified ? validate that this project is actually defining them.
+        if data and data.releasetarget
+          data.each_releasetarget do |rt|
+            found = false
+            prj.repositories.each do |r|
+              r.release_targets.each do |prt|
+                if rt.repository
+                  found = true if prt.target_repository.db_project.name == rt.project and prt.target_repository.name == rt.repository
+                else
+                  found = true if prt.target_repository.db_project.name == rt.project
+                end
+              end
+            end
+
+            unless found
+              render_error :status => 404, :errorcode => 'releasetarget_not_found',
+                :message => "Release target '#{rt.project}/#{rt.repository}' is not defined in this project '#{prj.name}'"
+              return
+            end
+          end
+        end
       end
 
       # _pattern was not a real package in former OBS 2.0 and before, so we need to create the

src/api/test/functional/maintenance_test.rb

@@ -819,15 +819,19 @@ def test_create_maintenance_project_and_release_packages
     assert_response :success
     assert_tag( :tag => "patchinfo", :attributes => { :incident => incidentID } )
     # add required informations about the update
-    pi = REXML::Document.new( @response.body )
-    pi.elements["//summary"].text = "if you are bored"
-    pi.elements["//description"].text = "if you are bored and really want fixes"
-    pi.elements["//rating"].text = "low"
-    pi.root.add_element "releasetarget", { "project" => "BaseDistro2.0:LinkedUpdateProject" }
-    pi.root.add_element "releasetarget", { "project" => "BaseDistro3" }
-    pi.root.add_element "issue", { "id" => "0815", "tracker" => "bnc" }
-    put "/source/#{incidentProject}/patchinfo/_patchinfo", pi.to_s
-    assert_response :success
+    pi = ActiveXML::Base.new( @response.body )
+    pi.summary.text = "if you are bored"
+    pi.description.text = "if you are bored and really want fixes"
+    pi.rating.text = "low"
+    pi.add_element "issue", { "id" => "0815", "tracker" => "bnc" }
+    pi.add_element "releasetarget", { :project => "BaseDistro2.0:LinkedUpdateProject" }
+    pi.add_element "releasetarget", { :project => "BaseDistro3" }
+    put "/source/#{incidentProject}/patchinfo/_patchinfo", pi.dump_xml
+    assert_response :success
+    pi.add_element "releasetarget", { :project => "home:tom" } # invalid target
+    put "/source/#{incidentProject}/patchinfo/_patchinfo", pi.dump_xml
+    assert_response 404
+    assert_tag :tag => "status", :attributes => { :code => "releasetarget_not_found" }
     get "/source/#{incidentProject}/patchinfo/_meta"
     assert_tag( :parent => {:tag => "build"}, :tag => "enable", :attributes => { :repository => nil, :arch => nil} )
     assert_tag( :parent => { :tag => "publish" }, :tag => "enable", :attributes => { :repository => nil, :arch => nil} )