diff options
author | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-07-11 18:26:00 +0300 |
---|---|---|
committer | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-07-12 13:14:54 +0300 |
commit | b7ffc097fbb61972e150a6d48cbe9e5194aed11b (patch) | |
tree | 5ce53ec32d98dadaf58951f8f9b064276b200a41 /lib/api/commits.rb | |
parent | 3a77664d1a550cfbedc92068926e4adae9c82b87 (diff) |
Allow collaboration with forks through the API
These APIs are used by the web IDE.
They need to be on par with git & web access, allowing edits from
maintainers to forks with merge requests that allow access.
Diffstat (limited to 'lib/api/commits.rb')
-rw-r--r-- | lib/api/commits.rb | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/lib/api/commits.rb b/lib/api/commits.rb index 964780cba6a..92329465b2c 100644 --- a/lib/api/commits.rb +++ b/lib/api/commits.rb @@ -6,6 +6,18 @@ module API before { authorize! :download_code, user_project } + helpers do + def user_access + @user_access ||= Gitlab::UserAccess.new(current_user, project: user_project) + end + + def authorize_push_to_branch!(branch) + unless user_access.can_push_to_branch?(branch) + forbidden!("You are not allowed to push into this branch") + end + end + end + params do requires :id, type: String, desc: 'The ID of a project' end @@ -67,7 +79,7 @@ module API optional :author_name, type: String, desc: 'Author name for commit' end post ':id/repository/commits' do - authorize! :push_code, user_project + authorize_push_to_branch!(params[:branch]) attrs = declared_params attrs[:branch_name] = attrs.delete(:branch) @@ -142,7 +154,7 @@ module API requires :branch, type: String, desc: 'The name of the branch' end post ':id/repository/commits/:sha/cherry_pick', requirements: API::COMMIT_ENDPOINT_REQUIREMENTS do - authorize! :push_code, user_project + authorize_push_to_branch!(params[:branch]) commit = user_project.commit(params[:sha]) not_found!('Commit') unless commit |