[api] do not allow to create requests when virtual target package is …

…not supported by type

src/api/app/controllers/request_controller.rb

@@ -684,7 +684,7 @@ def create_create
       tpkg = nil
 
       if action.target_project
-        tprj = Project.find_by_name action.target_project
+        tprj = Project.get_by_name action.target_project
         if action.target_package
           if action.target_repository and action.action_type == :delete
             render_error :status => 400, :errorcode => "invalid_request",
@@ -699,6 +699,9 @@ def create_create
             else
               tpkg = tprj.find_package action.target_package.gsub(/\.[^\.]*$/, '')
             end
+          elsif [ :set_bugowner, :add_role, :change_devel, :delete ].include? action.action_type 
+            # target must exists
+            tpkg = tprj.packages.find_by_name! action.target_package
           else
             # just the direct affected target
             tpkg = tprj.packages.find_by_name action.target_package

src/api/test/functional/request_controller_test.rb

@@ -2126,6 +2126,30 @@ def test_project_delete_request_with_pending
     assert_response :success
   end
 
+  def test_try_to_modify_virtual_package
+    prepare_request_with_user "Iggy", "asdfasdf"
+
+    get "/source/BaseDistro:Update/pack1/_meta"
+    assert_response :success
+    assert_xml_tag( :tag => "package", :attributes => { :project => "BaseDistro"} ) # it appears via project link
+
+    # and create a request to wrong target
+    [ "delete", "set_bugowner", "add_role", "change_devel" ].each do |at|
+      rq = '<request>
+             <action type="'+at+'">'
+      rq += "  <source project='BaseDistro' package='pack1'/>"        if at == "change_devel"
+      rq += '  <target project="BaseDistro:Update" package="pack1"/>'
+      rq += "  <person name='Iggy' role='reviewer' />"                if at == "add_role"
+      rq += '</action>
+             <state name="new" />
+           </request>'
+
+      post "/request?cmd=create", rq
+      assert_response 404
+      assert_xml_tag( :tag => "status", :attributes => { :code => "not_found"} )
+    end
+  end
+
   def test_repository_delete_request
     prepare_request_with_user "Iggy", "asdfasdf"
     meta="<project name='home:Iggy:todo'><title></title><description/><repository name='base'>