diff options
| author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2014-04-03 15:33:34 +0400 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2014-04-03 15:33:34 +0400 |
| commit | 207f34b890b58c09281850a37477948ec75e0ef4 (patch) | |
| tree | 1e4f0559f1355b1034a8fdf21034a949c9ac14df /lib | |
| parent | 6594ce1de042491a8ce27899b9ed1c00d0d3e684 (diff) | |
| parent | 8b35b208372e2394953226b7e4342d860a695f84 (diff) | |
Merge pull request #6190 from Popl7/add-better-branch-protection-against-history-rewrite-and-deletion
protect protected branched to force updates
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/api/internal.rb | 4 | ||||
| -rw-r--r-- | lib/gitlab/git_access.rb | 21 |
2 files changed, 16 insertions, 9 deletions
diff --git a/lib/api/internal.rb b/lib/api/internal.rb index bcf97574673..06c66ba0b35 100644 --- a/lib/api/internal.rb +++ b/lib/api/internal.rb @@ -10,6 +10,7 @@ module API # project - project path with namespace # action - git action (git-upload-pack or git-receive-pack) # ref - branch name + # forced_push - forced_push # get "/allowed" do # Check for *.wiki repositories. @@ -35,7 +36,8 @@ module API project, params[:ref], params[:oldrev], - params[:newrev] + params[:newrev], + params[:forced_push] ) end diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb index 1ab8f9213a3..a0401290cc0 100644 --- a/lib/gitlab/git_access.rb +++ b/lib/gitlab/git_access.rb @@ -5,7 +5,7 @@ module Gitlab attr_reader :params, :project, :git_cmd, :user - def allowed?(actor, cmd, project, ref = nil, oldrev = nil, newrev = nil) + def allowed?(actor, cmd, project, ref = nil, oldrev = nil, newrev = nil, forced_push = false) case cmd when *DOWNLOAD_COMMANDS if actor.is_a? User @@ -19,12 +19,12 @@ module Gitlab end when *PUSH_COMMANDS if actor.is_a? User - push_allowed?(actor, project, ref, oldrev, newrev) + push_allowed?(actor, project, ref, oldrev, newrev, forced_push) elsif actor.is_a? DeployKey # Deploy key not allowed to push return false elsif actor.is_a? Key - push_allowed?(actor.user, project, ref, oldrev, newrev) + push_allowed?(actor.user, project, ref, oldrev, newrev, forced_push) else raise 'Wrong actor' end @@ -41,13 +41,18 @@ module Gitlab end end - def push_allowed?(user, project, ref, oldrev, newrev) + def push_allowed?(user, project, ref, oldrev, newrev, forced_push) if user && user_allowed?(user) + action = if project.protected_branch?(ref) - :push_code_to_protected_branches - else - :push_code - end + if forced_push + :force_push_code_to_protected_branches + else + :push_code_to_protected_branches + end + else + :push_code + end user.can?(action, project) else false |