CVS integration allowing users to upload their own attachment when editing a release without a file

here i am attaching the screen shot for the page 'view all releases' where release get displayed.

Thanks for reporting this. I don't understand why, but for some reason the project release module is allowing you to upload your own release attachment, which is what you have done here. That shouldn't be allowed, since on drupal.org we use CVS and the automatic packaging script to handle packaging and attaching the release.

So the underlying problem here is something completely different than you just attaching the wrong file. As far as I know this has happened once fairly recently, but I don't have that issue at hand.

The project node itself seems to have the CVS repo and path filled in correctly, so I don't know why this is happening.

The fix here for your theme is probably to just delete the release node and allow you to try again. However, I don't have permissions do do that. Also, I want to leave things as they are so that dww (one of the project maintainers) can take a look at this release and try to figure out what's happening. I'll try to make sure he sees this soon so that your particular project can be fixed and you can release your theme for D6.

thanks for the reply.
i will wait for the fix.

Yay, I've finally been able to reproduce this behavior on project.drupal.org! ;) Here's how:

A) Create a release node for a project correctly configured with a CVS repository.
B) Before the packaging script runs (and a file exists), edit the release as a non admin user.
C) Behold the file upload UI.

I haven't debugged this yet, but I'm pretty sure the code at fault is from cvs.module, at the end of cvs_alter_project_release_form_edit():

  $file = db_fetch_object(db_query("SELECT file_path from {project_release_nodes} WHERE nid = %d", $release->nid));
  // Make sure the file upload UI is gone if this project has a repository set
  // because in that case users should *never* have a way to upload files.
  // Otherwise, if no repository is set for this project, keep the upload UI.
  if ((!$file || empty($file->file_path)) && project_use_cvs($project)) {
    unset($form['file']);
  }

I don't understand why that works for admins but not for regular project maintainers. Maybe this isn't exactly the spot that's failing. I'll have to actually debug it a little more to be sure. Stay tuned.

p.s. @cmswebsiteservices: I just removed that .png file from your release node and manually ran the packaging script for your project. Your 6.x-1.x-dev release now has a proper tarball. While I was looking around, I noticed your project has a DRUPAL-5 branch, but the 5.x-1.x-dev release is still pointing to HEAD. You should edit that release and you'll be able to switch the CVS branch for it from HEAD to DRUPAL-5. Not only does that better represent the reality of your code, it also means that HEAD will again be available for you to create another release node, e.g. for 7.x-1.x-dev when you start working on that. Cheers.

Dumb bug: $project was only properly initialized inside an if().

I've applied this patch on project.drupal.org and scratch.drupal.org. I've tested it myself and I haven't seen any problems. Anyone else care to give this a look before I commit and deploy for real? Thanks.

Makes a lot of sense to me. Unfortunately I have neither time nor motivation to do the testing too... isn't there a "reviewed by the community" status without the testing stuff? Thus, I support it from the logical and coding point of view (and you already tested it anyways, didn't you?). Set RTBC? Don't set RTBC? Who knows. Do you think splitting those two could make it easier to get core patches RTBC'd? Totally off-topic, of course.

This has been running on d.o for weeks. Committed to HEAD and DRUPAL-5.