Unverified Commit 0bf99f65 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets
Browse files

Developers can push to wiki repo. Protected branches does not affect wiki repo any more


Signed-off-by: default avatarDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
parent d64cc2079a7c
......@@ -14,13 +14,20 @@ class Internal < Grape::API
#
post "/allowed" do
status 200
project_path = params[:project]
# Check for *.wiki repositories.
# Strip out the .wiki from the pathname before finding the
# project. This applies the correct project permissions to
# the wiki repository as well.
project_path = params[:project]
project_path.gsub!(/\.wiki/,'') if project_path =~ /\.wiki/
access =
if project_path =~ /\.wiki\Z/
project_path = project_path[0..-6]
Gitlab::GitAccessWiki.new
else
Gitlab::GitAccess.new
end
project = Project.find_with_namespace(project_path)
return false unless project
......@@ -32,7 +39,7 @@ class Internal < Grape::API
return false unless actor
Gitlab::GitAccess.new.allowed?(
access.allowed?(
actor,
params[:action],
project,
......
......@@ -49,25 +49,7 @@ def push_allowed?(user, project, changes)
# Iterate over all changes to find if user allowed all of them to be applied
changes.each do |change|
oldrev, newrev, ref = change.split(' ')
action = if project.protected_branch?(branch_name(ref))
# we dont allow force push to protected branch
if forced_push?(project, oldrev, newrev)
:force_push_code_to_protected_branches
# and we dont allow remove of protected branch
elsif newrev =~ /0000000/
:remove_protected_branches
else
:push_code_to_protected_branches
end
elsif project.repository && project.repository.tag_names.include?(tag_name(ref))
# Prevent any changes to existing git tag unless user has permissions
:admin_project
else
:push_code
end
unless user.can?(action, project)
unless change_allowed?(user, project, change)
# If user does not have access to make at least one change - cancel all push
return false
end
......@@ -77,6 +59,29 @@ def push_allowed?(user, project, changes)
true
end
def change_allowed?(user, project, change)
oldrev, newrev, ref = change.split(' ')
action = if project.protected_branch?(branch_name(ref))
# we dont allow force push to protected branch
if forced_push?(project, oldrev, newrev)
:force_push_code_to_protected_branches
# and we dont allow remove of protected branch
elsif newrev =~ /0000000/
:remove_protected_branches
else
:push_code_to_protected_branches
end
elsif project.repository && project.repository.tag_names.include?(tag_name(ref))
# Prevent any changes to existing git tag unless user has permissions
:admin_project
else
:push_code
end
user.can?(action, project)
end
def forced_push?(project, oldrev, newrev)
return false if project.empty_repo?
......
module Gitlab
class GitAccessWiki < GitAccess
def change_allowed?(user, project, change)
user.can?(:write_wiki, project)
end
end
end
require 'spec_helper'
describe Gitlab::GitAccessWiki do
let(:access) { Gitlab::GitAccessWiki.new }
let(:project) { create(:project) }
let(:user) { create(:user) }
describe 'push_allowed?' do
before do
create(:protected_branch, name: 'master', project: project)
project.team << [user, :developer]
end
subject { access.push_allowed?(user, project, changes) }
it { should be_true }
end
def changes
['6f6d7e7ed 570e7b2ab refs/heads/master']
end
end
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment