tree 15cdc9e169024139dade54fca84db292ad1a5325
parent 40a43748b10e4e452e7768c1d407370a6daa8c08
author Edwin Kempin <ekempin@google.com> 1538469153 +0200
committer Edwin Kempin <ekempin@google.com> 1538473550 +0200

PostReview: Fix permission check for setting wip/ready

The work-in-progress flag on a change can be toggled by the change
owner, the project owner and admins.

The SetWorkInProgress and SetReadyForReview REST endpoints properly
checked the permissions and also the corresponding UI actions were
enabled/disabled based on these permission. However when the
work-in-progress flag was toggled from PostReview the request was denied
if the user was a non-change-owner. As result of this project owners and
admins could see the action in PolyGerrit but clicking on it failed.

To fix this the permission checks are now implemented by a static method
in WorkInProgressOp that can be reused from all the places.

This changes the response code for PostReview if a user is not allowed
to toggle the work-in-progress flag to 403 Forbidden. Previously it was
returning 400 Bad Request which was wrong since 400 Bad Request should
only be returned if the request has a malformed syntax, required input
fields are missing or mutally exclusive input fields are used together,
but not if permissions are missing.

Bug: Issue 9787
Change-Id: Ica169002e36c1d8070c403a3d7103a6f70060c28
Signed-off-by: Edwin Kempin <ekempin@google.com>