Security for online editor. Replace dev_access?, master_access? with can? method usage

2 files changed, 6 insertions, 1 deletions

diff --git a/app/roles/authority.rb b/app/roles/authority.rb
index dbdd98397b9..e0796d5f120 100644
--- a/app/roles/authority.rb
+++ b/app/roles/authority.rb
@@ -53,6 +53,6 @@ module Authority
   end
 
   def master_access_for?(user)
-    !users_projects.where(user_id: user.id, project_access: [UsersProject::MASTER]).empty? || owner_id == user.id
+    !users_projects.where(user_id: user.id, project_access: [UsersProject::MASTER]).empty?
   end
 end
diff --git a/app/roles/repository.rb b/app/roles/repository.rb
index 88fd90d061f..882ec31033c 100644
--- a/app/roles/repository.rb
+++ b/app/roles/repository.rb
@@ -181,4 +181,9 @@ module Repository
   def http_url_to_repo
     http_url = [Gitlab.config.url, "/", path, ".git"].join('')
   end
+
+  # Check if current branch name is marked as protected in the system
+  def protected_branch? branch_name
+    protected_branches.map(&:name).include?(branch_name)
+  end
 end