[extensions-web] Review: restrict Reject option to reviewers

[Yuri Konotopov <ykonotopov src gnome org>]

commit a59ef2d91e97ddcab4f8124a06e87398de7be0d3
Author: Andy Holmes <andrew g r holmes gmail com>
Date:   Thu Feb 27 16:45:24 2020 -0800

    Review: restrict Reject option to reviewers
    
    Users have been discouraged from using the Reject action on their own
    extensions for quite awhile. This disrupts the diff review flow since
    new submissions need to be manually checked to ensure we don't miss
    buggy/malicious in a version rejected by a user.
    
    fixes #99

 sweettooth/review/templates/review/review.html | 2 +-
 sweettooth/review/views.py                     | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)
---
diff --git a/sweettooth/review/templates/review/review.html b/sweettooth/review/templates/review/review.html
index e22cbac..b2557eb 100644
--- a/sweettooth/review/templates/review/review.html
+++ b/sweettooth/review/templates/review/review.html
@@ -129,8 +129,8 @@
       <option value="none" selected>No change</option>
 {% if can_approve %}
       <option value="approve" class="approve">Approve</option>
-{% endif %}
       <option value="reject" class="reject">Reject</option>
+{% endif %}
       <option value="wait" class="waiting">Needs reply from author</option>
     </select>
     <input type="submit" value="Submit">
diff --git a/sweettooth/review/views.py b/sweettooth/review/views.py
index 6de1266..8355bf2 100644
--- a/sweettooth/review/views.py
+++ b/sweettooth/review/views.py
@@ -250,6 +250,8 @@ def submit_review_view(request, obj):
     if newstatus is not None:
         if newstatus == models.STATUS_ACTIVE and not can_approve:
             return HttpResponseForbidden()
+        elif newstatus == models.STATUS_REJECTED and not can_approve:
+            return HttpResponseForbidden()
 
         review.new_status = newstatus
         version.status = newstatus