diff options
| author | Pawel Chojnacki <pawel@chojnacki.ws> | 2017-04-28 16:05:00 +0200 |
|---|---|---|
| committer | Pawel Chojnacki <pawel@chojnacki.ws> | 2017-04-28 16:05:00 +0200 |
| commit | 19edeba8e3e8d091853ceed27f271cd67a636551 (patch) | |
| tree | 69aec50650e2a771b5d601e3ac12436620dee65c | |
| parent | 61046e75d8e6f660e55f4f7b5a76238611a0f48f (diff) | |
| download | gitlab-ce-19edeba8e3e8d091853ceed27f271cd67a636551.tar.gz | |
Prevent people from creating branches if they don't have persmission to push
3 files changed, 7 insertions, 5 deletions
diff --git a/changelogs/unreleased/28968-prevent-people-from-creating-branches-if-they-don-have-permission-to-push.yml b/changelogs/unreleased/28968-prevent-people-from-creating-branches-if-they-don-have-permission-to-push.yml new file mode 100644 index 00000000000..6612cfd8866 --- /dev/null +++ b/changelogs/unreleased/28968-prevent-people-from-creating-branches-if-they-don-have-permission-to-push.yml @@ -0,0 +1,4 @@ +--- +title: Prevent people from creating branches if they don't have persmission to push +merge_request: +author: diff --git a/lib/gitlab/user_access.rb b/lib/gitlab/user_access.rb index 54728e5ff0e..e46ff313654 100644 --- a/lib/gitlab/user_access.rb +++ b/lib/gitlab/user_access.rb @@ -44,9 +44,7 @@ module Gitlab if ProtectedBranch.protected?(project, ref) return true if project.empty_repo? && project.user_can_push_to_empty_repo?(user) - has_access = project.protected_branches.protected_ref_accessible_to?(ref, user, action: :push) - - has_access || !project.repository.branch_exists?(ref) && can_merge_to_branch?(ref) + project.protected_branches.protected_ref_accessible_to?(ref, user, action: :push) else user.can?(:push_code, project) end diff --git a/spec/lib/gitlab/user_access_spec.rb b/spec/lib/gitlab/user_access_spec.rb index 611cdbbc865..2b27ff66c09 100644 --- a/spec/lib/gitlab/user_access_spec.rb +++ b/spec/lib/gitlab/user_access_spec.rb @@ -87,10 +87,10 @@ describe Gitlab::UserAccess, lib: true do expect(access.can_push_to_branch?(branch.name)).to be_falsey end - it 'returns true if branch does not exist and user has permission to merge' do + it 'returns false if branch does not exist' do project.team << [user, :developer] - expect(access.can_push_to_branch?(not_existing_branch.name)).to be_truthy + expect(access.can_push_to_branch?(not_existing_branch.name)).to be_falsey end end |