From 375c5fcc987116af6ea3c4c401388a819294b520 Mon Sep 17 00:00:00 2001
From: Dhriti Shikhar <dhriti.shikhar.rokz@gmail.com>
Date: Oct 02 2015 11:55:15 +0000
Subject: [PATCH 1/4] Lets a PR submitter close a PR


---

diff --git a/pagure/templates/pull_request.html b/pagure/templates/pull_request.html
index 9ed3346..c58a199 100644
--- a/pagure/templates/pull_request.html
+++ b/pagure/templates/pull_request.html
@@ -40,6 +40,7 @@
           <input class="button" type="submit" value="Merge"/>
         </form>
       </li>
+  {% elif pull_request.status == 'Open' and (repo_admin or g.fas_user.username == pull_request.user.username) %}
       <li>
         <form action="{{ url_for('cancel_request_pull', username=username,
             repo=repo.name, requestid=requestid) }}" method="POST">
diff --git a/pagure/ui/fork.py b/pagure/ui/fork.py
index 13e209e..adc0621 100644
--- a/pagure/ui/fork.py
+++ b/pagure/ui/fork.py
@@ -628,10 +628,10 @@ def cancel_request_pull(repo, requestid, username=None):
         if not request:
             flask.abort(404, 'Pull-request not found')
 
-        if not is_repo_admin(repo_obj):
-            flask.abort(
-                403,
-                'You are not allowed to cancel pull-request for this project')
+        if not is_repo_admin(repo_obj) and not flask.g.fas_user.username:
+          flask.abort(
+              403,
+              'You are not allowed to cancel pull-request for this project')
 
         pagure.lib.close_pull_request(
             SESSION, request, flask.g.fas_user.username,

From 29271b609ddff408909a0dd22efdacde24c9257c Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Oct 02 2015 11:57:21 +0000
Subject: [PATCH 2/4] Only the person that opened the PR can close it


---

diff --git a/pagure/templates/pull_request.html b/pagure/templates/pull_request.html
index c58a199..1c547bc 100644
--- a/pagure/templates/pull_request.html
+++ b/pagure/templates/pull_request.html
@@ -40,7 +40,8 @@
           <input class="button" type="submit" value="Merge"/>
         </form>
       </li>
-  {% elif pull_request.status == 'Open' and (repo_admin or g.fas_user.username == pull_request.user.username) %}
+  {% elif pull_request.status == 'Open' and
+        (repo_admin or g.fas_user.username == pull_request.user.username) %}
       <li>
         <form action="{{ url_for('cancel_request_pull', username=username,
             repo=repo.name, requestid=requestid) }}" method="POST">
diff --git a/pagure/ui/fork.py b/pagure/ui/fork.py
index adc0621..f6a51fb 100644
--- a/pagure/ui/fork.py
+++ b/pagure/ui/fork.py
@@ -628,7 +628,8 @@ def cancel_request_pull(repo, requestid, username=None):
         if not request:
             flask.abort(404, 'Pull-request not found')
 
-        if not is_repo_admin(repo_obj) and not flask.g.fas_user.username:
+        if not is_repo_admin(repo_obj) \
+            and not flask.g.fas_user.username == request.user.username:
           flask.abort(
               403,
               'You are not allowed to cancel pull-request for this project')

From 36c1c9db1c0795d3125a16abd6eae46c73507c62 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Oct 02 2015 11:57:36 +0000
Subject: [PATCH 3/4] Repos can have a different default branch than `master`


---

diff --git a/pagure/lib/__init__.py b/pagure/lib/__init__.py
index 01046a9..67d3a85 100644
--- a/pagure/lib/__init__.py
+++ b/pagure/lib/__init__.py
@@ -1170,10 +1170,10 @@ def fork_project(session, user, repo, gitfolder,
     frepo = pygit2.clone_repository(reponame, forkreponame, bare=True)
     # Clone all the branches as well
     for branch in frepo.listall_branches(pygit2.GIT_BRANCH_REMOTE):
-        if branch == 'origin/master':
-            continue
         br = frepo.lookup_branch(branch, pygit2.GIT_BRANCH_REMOTE)
         name = br.branch_name.replace(br.remote_name, '')[1:]
+        if name in frepo.listall_branches(pygit2.GIT_BRANCH_LOCAL):
+            continue
         frepo.create_branch(name, frepo.get(br.target.hex))
 
     docrepo = os.path.join(docfolder, project.path)

From cd3dffc44108a7c6157a6d6cef0cfe84bb4ac329 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Oct 02 2015 12:01:08 +0000
Subject: [PATCH 4/4] Ensure the user is authenticated before checking it's username


---

diff --git a/pagure/templates/pull_request.html b/pagure/templates/pull_request.html
index 1c547bc..78a756a 100644
--- a/pagure/templates/pull_request.html
+++ b/pagure/templates/pull_request.html
@@ -40,7 +40,7 @@
           <input class="button" type="submit" value="Merge"/>
         </form>
       </li>
-  {% elif pull_request.status == 'Open' and
+  {% elif pull_request.status == 'Open' and authenticated and
         (repo_admin or g.fas_user.username == pull_request.user.username) %}
       <li>
         <form action="{{ url_for('cancel_request_pull', username=username,