1330656 - no error shown when user didn't have permission to delete or add a release

Status: RESOLVED DUPLICATE of bug 1336452

(Release Engineering Graveyard :: Applications: Balrog (frontend), defect, P3)

Description

[[e-mail] (:bhearsum)]

sfraser recently tried to add and delete a release in Balrog before he was granted permission. It didn't let him, but it also didn't show any useful error, just "Form submission error".

AFAICT, we return a 403 with a useful error message in this case, but the message doesn't end up anywhere in the UI. This may be broken for other types of changes, too.

Comment 1

[sshru]

Hi Ben, 

Would it be ok if I took this up as my first bug ? It would be great if you could let me know the steps I would need to follow to reproduce this issue and also where I could discuss any queries that I have while resolving the bug.

Comment 2

[[e-mail] (:bhearsum)]

(In reply to sshru from comment #1)
> Hi Ben, 
> 
> Would it be ok if I took this up as my first bug ? It would be great if you
> could let me know the steps I would need to follow to reproduce this issue
> and also where I could discuss any queries that I have while resolving the
> bug.

Yup, this is a good first bug.

Reproducing it is going to be a little tricky, but try the following:
1) Start up the development environment (http://mozilla-balrog.readthedocs.io/en/latest/contribute.html#usage)
2) Find the "Firefox-40.0.3-build1" release (http://localhost:8080/releases#Firefox-40), download it, then delete it.
3) Adjust your permissions so that you no longer have write access to Firefox Releases
3a) Go to http://localhost:8080/permissions
3b) Click "Update"
3c) Under "Current Permissions" enter '{"products": ["Fennec"]}' in the text field, then click "Save Changes".
4) Now try to re-add the "Firefox-40.0.3-build1" release.
4a) Go to http://localhost:8080/releases
4b) Click "Add a new Release"
4c) Click "Browse" and select the "Firefox-40.0.3-build1.json" that you downloaded earlier
4d) Enter "Firefox" for the product, and click "Save Changes".

You should see a big "Form Submission Error", but with no useful details. If you open the Developer Tools and look at the POST request in the Network tab, you'll see that there *is* a response returned that talks about Permission Denied.

If you have more questions or any trouble, the best way to get in contact is on IRC (irc://irc.mozilla.org/#balrog). There's a few different that should be able to help you out.

Comment 3

[sshru]

(In reply to Ben Hearsum (:bhearsum) from comment #2)
> (In reply to sshru from comment #1)
> > Hi Ben, 
> > 
> > Would it be ok if I took this up as my first bug ? It would be great if you
> > could let me know the steps I would need to follow to reproduce this issue
> > and also where I could discuss any queries that I have while resolving the
> > bug.
> 
> Yup, this is a good first bug.
> 
> Reproducing it is going to be a little tricky, but try the following:
> 1) Start up the development environment
> (http://mozilla-balrog.readthedocs.io/en/latest/contribute.html#usage)
> 2) Find the "Firefox-40.0.3-build1" release
> (http://localhost:8080/releases#Firefox-40), download it, then delete it.
> 3) Adjust your permissions so that you no longer have write access to
> Firefox Releases
> 3a) Go to http://localhost:8080/permissions
> 3b) Click "Update"
> 3c) Under "Current Permissions" enter '{"products": ["Fennec"]}' in the text
> field, then click "Save Changes".
> 4) Now try to re-add the "Firefox-40.0.3-build1" release.
> 4a) Go to http://localhost:8080/releases
> 4b) Click "Add a new Release"
> 4c) Click "Browse" and select the "Firefox-40.0.3-build1.json" that you
> downloaded earlier
> 4d) Enter "Firefox" for the product, and click "Save Changes".
> 
> You should see a big "Form Submission Error", but with no useful details. If
> you open the Developer Tools and look at the POST request in the Network
> tab, you'll see that there *is* a response returned that talks about
> Permission Denied.
> 
> If you have more questions or any trouble, the best way to get in contact is
> on IRC (irc://irc.mozilla.org/#balrog). There's a few different that should
> be able to help you out.

Thank you for the information. I will start working on it.

Comment 4

[[e-mail] (:bhearsum)]

Are you still planning to look at this?

Comment 5

[sshru]

(In reply to Ben Hearsum (:bhearsum) from comment #4)
> Are you still planning to look at this?

Hi Ben,

I did not get a chance to work on the bug. I was facing some issues with the environment setup. I would like to resume working on it tomorrow. Would that be okay?

Comment 6

[[e-mail] (:bhearsum)]

(In reply to sshru from comment #5)
> (In reply to Ben Hearsum (:bhearsum) from comment #4)
> > Are you still planning to look at this?
> 
> Hi Ben,
> 
> I did not get a chance to work on the bug. I was facing some issues with the
> environment setup. I would like to resume working on it tomorrow. Would that
> be okay?

Yep, that's totally fine. Just let us know if you need some help getting set up.

Comment 7

[[e-mail] (:bhearsum)]

Shruti, are you still planning to look at this?

Comment 8

[[e-mail] (:bhearsum)]

Unassigning due to inactivity. If you want to pick it up again, feel free to.

Comment 9

[[e-mail] (:bhearsum)]

This was fixed by bug 1336452.