1 files changed, 26 insertions, 1 deletions
diff --git a/app/models/namespace_setting.rb b/app/models/namespace_setting.rb
index fc890bf687c..4a39bfebda0 100644
--- a/app/models/namespace_setting.rb
+++ b/app/models/namespace_setting.rb
@@ -11,6 +11,9 @@ class NamespaceSetting < ApplicationRecord
   validate :allow_mfa_for_group
   validate :allow_resource_access_token_creation_for_group
 
+  before_save :set_prevent_sharing_groups_outside_hierarchy, if: -> { user_cap_enabled? }
+  after_save :disable_project_sharing!, if: -> { user_cap_enabled? }
+
   before_validation :normalize_default_branch_name
 
   NAMESPACE_SETTINGS_PARAMS = [:default_branch_name, :delayed_project_removal,
@@ -19,10 +22,20 @@ class NamespaceSetting < ApplicationRecord
 
   self.primary_key = :namespace_id
 
+  def prevent_sharing_groups_outside_hierarchy
+    return super if namespace.root?
+
+    namespace.root_ancestor.prevent_sharing_groups_outside_hierarchy
+  end
+
   private
 
   def normalize_default_branch_name
-    self.default_branch_name = nil if default_branch_name.blank?
+    self.default_branch_name = if default_branch_name.blank?
+                                 nil
+                               else
+                                 Sanitize.fragment(self.default_branch_name)
+                               end
   end
 
   def default_branch_name_content
@@ -44,6 +57,18 @@ class NamespaceSetting < ApplicationRecord
       errors.add(:resource_access_token_creation_allowed, _('is not allowed since the group is not top-level group.'))
     end
   end
+
+  def set_prevent_sharing_groups_outside_hierarchy
+    self.prevent_sharing_groups_outside_hierarchy = true
+  end
+
+  def disable_project_sharing!
+    namespace.update_attribute(:share_with_group_lock, true)
+  end
+
+  def user_cap_enabled?
+    new_user_signups_cap.present? && namespace.root?
+  end
 end
 
 NamespaceSetting.prepend_mod_with('NamespaceSetting')