Commit 77a0f5df authored by Georges Racinet's avatar Georges Racinet 🦑
Browse files

Repository files (multi_action): check publisher permission

This is a variant of #332 for multi_action.

As with the case of merge requests, the check should also be
performed at low level by Mercurial, but doing it at the model
level makes for early failure, avoiding atomicity issues.

A difference with MRs is that we don't have a simple way *not* to
propose the action to the user yet, because higher layers are more
complicated and don't involve checks, since they are meant to produce
forks for users without write permission.

This currently provides 500 errors, but at least it closes the
security problem, and we can later on add the necessary catching.

We didn't want to affect Wikis, because for them, allowing publication
for Developers is pretty normal.

branch : heptapod-stable
parent ff5823e89d14
......@@ -838,6 +838,16 @@ def multi_action(user, **options)
options[:start_repository] = start_project.repository.raw_repository
if repo_type == Gitlab::GlRepository::PROJECT && project.mercurial?
# not that :branch_name is required at lower level anyway
hg_branch, topic = Gitlab::Mercurial.parse_gitlab_branch_for_hg(
if topic.nil? && raw.hg_config_item_bool?('experimental.topic.publish-bare-branch')
access =, project: project)
raise ::Gitlab::HgAccess::ForbiddenError, "This action would create a public changeset on Mercurial branch '#{hg_branch}' which current user is not authorized to do" unless access.hg_can_publish?
with_cache_hooks { raw.multi_action(user, **options) }
......@@ -1023,6 +1023,7 @@ def multi_action(user, branch_name:, message:, actions:,
if topic.nil? && hg_config_item_bool?('experimental.topic.publish-bare-branch')
hg_changeset_publish(user, commit_hgsha, notify_gitlab: true)"#{logprefix} published changeset #{commit_hgsha}")
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment