Merge pull request 'feat(permissions): site admin only for delete' (#292) from fix/admin-delete-only into dev

routers/web/org/licenses.go

@@ -67,6 +67,7 @@ func Licenses(ctx *context.Context) {
 	}
 	ctx.Data["LicenseKeys"] = keys
 	ctx.Data["IsRepoAdmin"] = ctx.Org.IsOwner
+	ctx.Data["IsSiteAdmin"] = ctx.IsUserSiteAdmin()
 
 	ctx.HTML(http.StatusOK, tplOrgLicenses)
 }

routers/web/repo/licenses.go

@@ -225,8 +225,12 @@ func LicensesEditPackagePost(ctx *context.Context) {
 	ctx.Redirect(ctx.Repo.RepoLink + "/licenses")
 }
 
-// LicensesDeletePackage deletes a license package.
+// LicensesDeletePackage deletes a license package. Site admin only.
 func LicensesDeletePackage(ctx *context.Context) {
+	if !ctx.IsUserSiteAdmin() {
+		ctx.NotFound(nil)
+		return
+	}
 	pkgID := ctx.PathParamInt64("id")
 	if err := licenses.DeleteLicensePackage(ctx, pkgID); err != nil {
 		ctx.ServerError("DeleteLicensePackage", err)

services/context/repo.go

@@ -613,6 +613,7 @@ func repoAssignmentPrepareTemplateData(ctx *Context, data *repoAssignmentPrepare
 	ctx.Data["NumLicensePackages"] = numLicensePackages
 	ctx.Data["EnableLicenses"] = numLicensePackages > 0
 	ctx.Data["IsRepoAdmin"] = ctx.Repo.Permission.IsAdmin()
+	ctx.Data["IsSiteAdmin"] = ctx.IsUserSiteAdmin()
 
 	// Load repo update config for platform-aware UI.
 	repoUpdateCfg, _ := licenses_model.GetRepoConfig(ctx, repo.ID)

templates/repo/licenses.tmpl

@@ -56,12 +56,14 @@
 										<a class="ui tiny button" href="{{$.RepoLink}}/licenses/packages/{{.ID}}/edit" title="{{ctx.Locale.Tr "repo.licenses.edit_package"}}">
 											{{svg "octicon-pencil" 14}}
 										</a>
-										<form method="post" action="{{$.RepoLink}}/licenses/packages/{{.ID}}/delete" class="tw-inline" onsubmit="return confirm('Delete this package?')">
+										{{if $.IsSiteAdmin}}
+										<form method="post" action="{{$.RepoLink}}/licenses/packages/{{.ID}}/delete" class="tw-inline" onsubmit="return confirm('Delete this package? This action cannot be undone.')">
 											{{$.CsrfTokenHtml}}
 											<button class="ui tiny red button" type="submit" title="{{ctx.Locale.Tr "repo.licenses.delete_package"}}">
 												{{svg "octicon-trash" 14}}
 											</button>
 										</form>
+										{{end}}
 									</td>
 								{{end}}
 							</tr>