diff --git a/patchwork/api/patch.py b/patchwork/api/patch.py index dae4269b..48085316 100644 --- a/patchwork/api/patch.py +++ b/patchwork/api/patch.py @@ -425,7 +425,16 @@ def partial_update(self, request, *args, **kwargs): req_user_id = request.user.id is_maintainer = request.user.is_authenticated and ( obj.project in request.user.profile.maintainer_projects.all() + or request.user.is_superuser ) + non_attention_set_keys = [ + key for key in request.data if key != 'attention_set' + ] + + if non_attention_set_keys and not is_maintainer: + raise PermissionDenied( + detail='You do not have permission to edit patch properties.' + ) if 'attention_set' in request.data and request.method in ('PATCH',): attention_set = request.data.get('attention_set', None) diff --git a/patchwork/templatetags/patch.py b/patchwork/templatetags/patch.py index 26282d83..d19b2c35 100644 --- a/patchwork/templatetags/patch.py +++ b/patchwork/templatetags/patch.py @@ -79,7 +79,7 @@ def patch_commit_display(patch): @register.filter(name='patch_interest') def patch_interest(patch): - reviews = patch.attention_set.count() + reviews = patch.patchattentionset_set.filter(removed=False).count() review_title = ( f'has {reviews} interested reviewers' if reviews > 0 diff --git a/patchwork/views/patch.py b/patchwork/views/patch.py index 6c0e90f7..cbe71ba7 100644 --- a/patchwork/views/patch.py +++ b/patchwork/views/patch.py @@ -66,6 +66,7 @@ def patch_detail(request, project_id, msgid): is_maintainer = ( request.user.is_authenticated and project in request.user.profile.maintainer_projects.all() + or request.user.is_superuser ) form = None @@ -89,9 +90,7 @@ def patch_detail(request, project_id, msgid): elif action in ['add-interest', 'remove-interest']: if request.user.is_authenticated: if action == 'add-interest': - PatchAttentionSet.objects.get_or_create( - patch=patch, user=request.user - ) + PatchAttentionSet.objects.upsert(patch, [request.user.id]) message = ( 'You have declared interest in reviewing this patch' )