commit 9b08f324462e62872ac071175e16e7553ba76e2b
author Changcheng Xiao <xchangcheng@google.com> Mon Mar 26 15:11:01 2018 +0200
committer Changcheng Xiao <xchangcheng@google.com> Thu Mar 29 10:18:31 2018 +0200
tree 45be7252b56571e3906853d61de72b8222a06518
parent dc1e7ff434fd7fce90dd6f6c4e312280bd884bd0

Remove #isHidden: adjust the "ACCESS" permission check

This commit adjusts the "ACCESS" permission checks in this plugin to
check whether the project state is readable:

* If it's readable, then the "ACCESS" permission will be checked.
* If it's not readable, the project is only accessable by the project
owners. In this case, "READ_CONFIG" will be checked, which is only
holded by the project owners.

This commit should be a no-op and it's an essential step for removing
ProjectControl#isHidden, which is a non-permission check and thus
should not be called from the permission backend.

Change-Id: I68e41cfba6d7c6e31aeae75652755a3f6b53c3dd

src/main/java/com/googlesource/gerrit/plugins/replication/Destination.java

diff --git a/src/main/java/com/googlesource/gerrit/plugins/replication/Destination.java b/src/main/java/com/googlesource/gerrit/plugins/replication/Destination.java
index 8c44904..193f196 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/replication/Destination.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/replication/Destination.java
@@ -225,18 +225,21 @@
     return cnt;
   }
 
-  private boolean shouldReplicate(ProjectState projectState, CurrentUser user)
+  private boolean shouldReplicate(ProjectState state, CurrentUser user)
       throws PermissionBackendException {
     if (!config.replicateHiddenProjects()
-        && projectState.getProject().getState()
+        && state.getProject().getState()
             == com.google.gerrit.extensions.client.ProjectState.HIDDEN) {
       return false;
     }
+
+    // Hidden projects(permitsRead = false) should only be accessible by the project owners.
+    // READ_CONFIG is checked here because it's only allowed to project owners(ACCESS may also
+    // be allowed for other users).
+    ProjectPermission permissionToCheck =
+        state.statePermitsRead() ? ProjectPermission.ACCESS : ProjectPermission.READ_CONFIG;
     try {
-      permissionBackend
-          .user(user)
-          .project(projectState.getNameKey())
-          .check(ProjectPermission.ACCESS);
+      permissionBackend.user(user).project(state.getNameKey()).check(permissionToCheck);
       return true;
     } catch (AuthException e) {
       return false;