limit project-level actions to project-specific groupACLs

docs/admin/access.rst

@@ -203,6 +203,10 @@ will have privileges on the component, and members of the
 project-and-language-specific groups will not. The latter will, of course, have
 privileges on their language in all other components of the project.
 
+For project-level actions (such as pushing upstream, setting priority, etc.),
+you must create a group ACL locked to *only* the project. Combinations, such
+as project plus language, only apply to actions on individual translations.
+
 Managing users and groups
 -------------------------
 

weblate/trans/permissions.py

@@ -54,7 +54,9 @@ def has_group_perm(user, permission, translation=None, project=None):
             Q(subproject=translation.subproject)
         ))
     elif project is not None:
-        acls = list(GroupACL.objects.filter(project=project))
+        acls = list(GroupACL.objects.filter(
+            project=project, subproject=None, language=None
+        ))
     else:
         return False
 

weblate/trans/tests/test_permissions.py

@@ -248,3 +248,26 @@ class GroupACLTest(ModelTestCase):
 
         self.assertTrue(can_edit(self.privileged, trans_cs, perm_name))
         self.assertFalse(can_edit(self.privileged, trans_de, perm_name))
+
+    def test_project_specific(self):
+        permission = Permission.objects.get(
+            codename='author_translation', content_type__app_label='trans'
+        )
+        self.group.permissions.add(permission)
+
+        acl_project_lang = GroupACL.objects.create(
+            language=self.language,
+            project=self.project
+        )
+        acl_project_lang.groups.add(self.group)
+
+        self.assertFalse(check_permission(
+            self.privileged, self.project, 'trans.author_translation'
+        ))
+
+        acl_project_only = GroupACL.objects.create(project=self.project)
+        acl_project_only.groups.add(self.group)
+
+        self.assertTrue(check_permission(
+            self.privileged, self.project, 'trans.author_translation'
+        ))