Read about our upcoming Code of Conduct on this issue

Commit 5ebe5134 authored by Georges Racinet's avatar Georges Racinet 🦑
Browse files

Protected branches: deletion protection when no one allowed to push

As demonstrated by a functional test,
Maintainers were still able to remove the protected branch even if
push level was set to `NO_ONE`. The reason is the underlying 'web'
protocol. The fix is harsh, but removal is a special case
and the explicit message to unprotect the branch should be
acceptable.

--HG--
branch : heptapod-stable
parent b9859c4b49e1
......@@ -8,6 +8,7 @@ class BranchCheck < BaseChecker
force_push_protected_branch: 'You are not allowed to force push code to a protected branch on this project.',
non_master_delete_protected_branch: 'You are not allowed to delete protected branches from this project. Only a project maintainer or owner can delete a protected branch.',
non_web_delete_protected_branch: 'You can only delete protected branches using the web interface.',
mercurial_delete_protected_branch: 'No push is allowed to delete protected branches on Mercurial project. If that was your intent, you will have to unprotect it first',
merge_protected_branch: 'You are not allowed to merge code into protected branches on this project.',
push_protected_branch: 'You are not allowed to push code to protected branches on this project.',
create_protected_branch: 'You are not allowed to create protected branches on this project.',
......@@ -91,6 +92,14 @@ def protected_branch_deletion_checks
raise GitAccess::ForbiddenError, ERROR_MESSAGES[:non_master_delete_protected_branch]
end
# Currently all Mercurial pushes have protocol equal to 'web'
# and that's what updated_from_web? checks.
# Mercurial projects, don't offer an actual "web" branch deletion,
# so it's preferable to just tell people to unprotect the branch
if project.mercurial?
raise GitAccess::ForbiddenError, ERROR_MESSAGES[:mercurial_delete_protected_branch]
end
unless updated_from_web?
raise GitAccess::ForbiddenError, ERROR_MESSAGES[:non_web_delete_protected_branch]
end
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment